OAuth Access
| action | Description | Sample | Rule |
|---|---|---|---|
| oauth_ | An OAuth access token was generated. | Y | N |
| oauth_ | An OAuth access token was deleted. | Y | N |
| oauth_ | An OAuth access token was regenerated. | Y | N |
| oauth_ | An OAuth access token was revoked. | N | N |
| oauth_ | An OAuth access token was updated. | N | N |
oauth_access.create
#Description
An OAuth access token was generated.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1777695697705,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMA==",
"action": "oauth_access.create",
"actor": "user",
"actor_id": 9000002,
"created_at": 1777695697705,
"hashed_token": null,
"oauth_application_name": "GitHub CLI",
"operation_type": "create",
"request_access_security_header": null,
"request_id": "E579:20CA55:468831B:476E0EC:69F57BCF",
"token_id": 9300000007,
"token_scopes": "gist,read:org,repo,workflow",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0",
"user_id": 9000002
}
References #
oauth_access.destroy
#Description
An OAuth access token was deleted.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1781214274718,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMQ==",
"action": "oauth_access.destroy",
"created_at": 1781214274718,
"explanation": "stale",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQAAAAAAAAA=",
"oauth_application_name": "Gist",
"operation_type": "remove",
"token_id": 9300000002,
"token_scopes": "",
"user": "user",
"user_id": 9000002
}
References #
oauth_access.regenerate
#Description
An OAuth access token was regenerated.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1774594019596,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMg==",
"action": "oauth_access.regenerate",
"actor": "user",
"actor_id": 9000002,
"created_at": 1774594019596,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMgAAAAAAAAA=",
"oauth_application_name": "GitHub.dev Lightweight Web Editor",
"operation_type": "modify",
"request_access_security_header": null,
"request_id": "D147:17A2E4:86F8A8:88D606:69C627E3",
"token_id": 9300000005,
"token_scopes": "codespace,read:user,repo,user:email,workflow",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
oauth_access.revoke
#Description
An OAuth access token was revoked.
Documented on GitHub's user audit log reference.
oauth_access.update
#Description
An OAuth access token was updated.
Documented on GitHub's user audit log reference.