Code Scanning

actionDescriptionSampleRule
code_scanning.alert_appeared_in_branchExisting code scanning alerts appeared in a branch.YN
code_scanning.alert_closed_became_fixedCode scanning alerts were fixed.YN
code_scanning.alert_closed_became_outdatedCode scanning alerts were closed as outdated (all configurations they were detected in were deleted).NN
code_scanning.alert_closed_by_userCode scanning alerts were manually dismissed.YN
code_scanning.alert_closure_approvedDismissal of code scanning alerts was approved.NN
code_scanning.alert_closure_deniedDismissal of code scanning alerts was denied.NN
code_scanning.alert_closure_requestedDismissal of code scanning alerts was requested.NN
code_scanning.alert_createdCode scanning alerts were seen for the first time.YN
code_scanning.alert_reappearedCode scanning alerts that were previously fixed reappeared.YN
code_scanning.alert_reopened_by_userCode scanning alerts that were previously dismissed were reopened.NN

code_scanning.alert_appeared_in_branch

#
Category
code-scanning

Description

Existing code scanning alerts appeared in a branch.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000009,
  "created_at": 1784233122754.0,
  "business_id": 9000005,
  "org": "example-org",
  "ref": "example-branch-12",
  "repo": "user/example-repo",
  "action": "code_scanning.alert_appeared_in_branch",
  "business": "example-business",
  "commit_oid": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000018,
  "alert_numbers": [
    571,
    209,
    511,
    360,
    576,
    577,
    578
  ]
}

References #

code_scanning.alert_closed_became_fixed

#
Category
code-scanning

Description

Code scanning alerts were fixed.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000019,
  "repo_id": 9000020,
  "created_at": 1784380672304.0,
  "business_id": 9000005,
  "org": "example-org",
  "ref": "refs/heads/example-branch-5",
  "repo": "user/example-repo",
  "action": "code_scanning.alert_closed_became_fixed",
  "business": "example-business",
  "commit_oid": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000021,
  "alert_numbers": [
    38,
    37,
    36,
    35,
    34,
    33,
    32,
    31
  ]
}

References #

code_scanning.alert_closed_became_outdated

#
Category
code-scanning

Description

Code scanning alerts were closed as outdated (all configurations they were detected in were deleted).

Documented on GitHub's enterprise audit log reference.

code_scanning.alert_closed_by_user

#
Category
code-scanning

Description

Code scanning alerts were manually dismissed.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000009,
  "actor_id": 9000022,
  "created_at": 1784822725520.0,
  "business_id": 9000005,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "code_scanning.alert_closed_by_user",
  "business": "example-business",
  "request_id": 9000023,
  "alert_numbers": [
    707
  ]
}

References #

code_scanning.alert_closure_approved

#
Category
code-scanning

Description

Dismissal of code scanning alerts was approved.

Documented on GitHub's enterprise audit log reference.

code_scanning.alert_closure_denied

#
Category
code-scanning

Description

Dismissal of code scanning alerts was denied.

Documented on GitHub's enterprise audit log reference.

code_scanning.alert_closure_requested

#
Category
code-scanning

Description

Dismissal of code scanning alerts was requested.

Documented on GitHub's enterprise audit log reference.

code_scanning.alert_created

#
Category
code-scanning

Description

Code scanning alerts were seen for the first time.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000019,
  "repo_id": 9000024,
  "created_at": 1780298625246.0,
  "business_id": 9000005,
  "org": "example-org",
  "ref": "example-branch-14",
  "repo": "user/example-repo",
  "action": "code_scanning.alert_created",
  "business": "example-business",
  "commit_oid": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000025,
  "alert_numbers": [
    8,
    9
  ]
}

References #

code_scanning.alert_reappeared

#
Category
code-scanning

Description

Code scanning alerts that were previously fixed reappeared.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000019,
  "repo_id": 9000020,
  "created_at": 1784985507082.0,
  "business_id": 9000005,
  "org": "example-org",
  "ref": "refs/heads/example-branch-5",
  "repo": "user/example-repo",
  "action": "code_scanning.alert_reappeared",
  "business": "example-business",
  "commit_oid": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000026,
  "alert_numbers": [
    31,
    32,
    33,
    34,
    35,
    36,
    37,
    38
  ]
}

References #

code_scanning.alert_reopened_by_user

#
Category
code-scanning

Description

Code scanning alerts that were previously dismissed were reopened.

Documented on GitHub's enterprise audit log reference.