Enterprise
| action | Description | Sample | Rule |
|---|---|---|---|
| enterprise. | A new just-in-time GitHub Actions self-hosted runner was configured | N | N |
| enterprise. | A new GitHub Actions self-hosted runner was registered. | Y | Y |
| enterprise. | A GitHub Actions self-hosted runner was removed. | N | N |
| enterprise. | A GitHub Actions self-hosted runner group was created. | N | N |
| enterprise. | A GitHub Actions self-hosted runner group was removed. | N | N |
| enterprise. | A GitHub Actions self-hosted runner group was renamed. | N | N |
| enterprise. | The REST API was used to remove a GitHub Actions self-hosted runner from a group. | N | N |
| enterprise. | A GitHub Actions self-hosted runner was added to a group. | N | N |
| enterprise. | A GitHub Actions runner group's list of members was updated. | N | N |
| enterprise. | The configuration of a GitHub Actions self-hosted runner group was changed. | N | N |
| enterprise. | The visibility of a GitHub Actions self-hosted runner group was updated via the REST API. | N | N |
| enterprise. | The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports. | N | N |
| enterprise. | The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports. | N | N |
| enterprise. | The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export. | N | N |
enterprise.configure_self_hosted_jit_runner
#Description
A new just-in-time GitHub Actions self-hosted runner was configured
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.register_self_hosted_runner
#Description
A new GitHub Actions self-hosted runner was registered.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"@timestamp": 1736846446162,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA2Mg==",
"action": "enterprise.register_self_hosted_runner",
"actor": "entadmin01",
"actor_id": 9000003,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9500001,
"created_at": 1736846446162,
"operation_type": "create",
"request_access_security_header": null,
"user_agent": "GitHubActionsRunner-linux-x64/2.321.0 ClientId/00000000-0000-0000-0000-000000000000 CommitSHA/e249007931b7c8e857797fa259c167f0bd4f997a Pid/266051 CreationTime/2025-01-14T09%3A20%3A45.5913104Z (Runner)"
}
Detection Rules #
Elastic #
T1195, T1195.001, T1195.002Splunk #
T1195, T1685References #
enterprise.remove_self_hosted_runner
#Description
A GitHub Actions self-hosted runner was removed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_created
#Description
A GitHub Actions self-hosted runner group was created.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_removed
#Description
A GitHub Actions self-hosted runner group was removed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_renamed
#Description
A GitHub Actions self-hosted runner group was renamed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_runner_removed
#Description
The REST API was used to remove a GitHub Actions self-hosted runner from a group.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_runners_added
#Description
A GitHub Actions self-hosted runner was added to a group.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_runners_updated
#Description
A GitHub Actions runner group's list of members was updated.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_updated
#Description
The configuration of a GitHub Actions self-hosted runner group was changed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_visiblity_updated
#Description
The visibility of a GitHub Actions self-hosted runner group was updated via the REST API.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.self_hosted_runner_offline
#Description
The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.self_hosted_runner_online
#Description
The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.self_hosted_runner_updated
#Description
The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.