Organization Role
| action | Description | Sample | Rule |
|---|---|---|---|
| organization_ | An organization role was assigned to a user or team. | Y | N |
| organization_ | A custom organization role was created in an organization. | N | N |
| organization_ | A custom organization role was deleted in an organization. | N | N |
| organization_ | A user or team was unassigned an organization role. | Y | N |
| organization_ | A custom organization role was edited in an organization. | N | N |
organization_role.assign
#Description
An organization role was assigned to a user or team.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000002,
"user_id": 9000165,
"actor_id": 9000166,
"created_at": 1784650287303.0,
"business_id": 9000005,
"actor_is_bot": false,
"organization_role_id": 9000167,
"org": "example-org",
"user": "user",
"actor": "user",
"action": "organization_role.assign",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000168,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"organization_role_name": "all_repo_read",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
References #
organization_role.create
#Description
A custom organization role was created in an organization.
Documented on GitHub's enterprise audit log reference.
organization_role.destroy
#Description
A custom organization role was deleted in an organization.
Documented on GitHub's enterprise audit log reference.
organization_role.revoke
#Description
A user or team was unassigned an organization role.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783957680294,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMTQ=",
"action": "organization_role.revoke",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783957680294,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "remove",
"org": "example-org",
"org_id": 9000004,
"organization_role_id": 9000009,
"organization_role_name": "security_manager",
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "BF08:15A139:F701E40:FBCB1C0:6A5508B0",
"team": "example-business-3/example-team-16",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
References #
organization_role.update
#Description
A custom organization role was edited in an organization.
Documented on GitHub's enterprise audit log reference.