OAuth Authorization
| action | Description | Sample | Rule |
|---|---|---|---|
| oauth_ | An authorization for an OAuth application was created. | Y | N |
| oauth_ | An authorization for an OAuth application was deleted. | N | N |
| oauth_ | An authorization for an OAuth application was updated. | Y | N |
oauth_authorization.create
#- Category
- oauth-authorization
Description
An authorization for an OAuth application was created.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1774594019579,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxMw==",
"action": "oauth_authorization.create",
"actor": "user",
"actor_id": 9000002,
"created_at": 1774594019579,
"oauth_application_name": "GitHub.dev Lightweight Web Editor",
"operation_type": "create",
"request_access_security_header": null,
"request_id": "D147:17A2E4:86F8A8:88D606:69C627E3",
"token_scopes": "codespace,read:user,repo,user:email,workflow",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
oauth_authorization.destroy
#- Category
- oauth-authorization
Description
An authorization for an OAuth application was deleted.
Documented on GitHub's user audit log reference.
oauth_authorization.update
#- Category
- oauth-authorization
Description
An authorization for an OAuth application was updated.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1772315603240,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAxNA==",
"action": "oauth_authorization.update",
"actor": "user",
"actor_id": 9000002,
"created_at": 1772315603240,
"oauth_application_name": "GitHub CLI",
"operation_type": "modify",
"request_access_security_header": null,
"request_id": "D1CE:202D44:11357E5:152FE38:69A363D0",
"token_scopes": "admin:public_key,gist,read:org,repo,workflow",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0",
"user_id": 9000002
}
References #