User
| action | Description | Sample | Rule |
|---|---|---|---|
| user. | An email address was added to a user account. | N | N |
| user. | An asynchronous job was started to destroy a user account, eventually triggering a user.delete event. | N | N |
| user. | Audit log entries were exported. | N | N |
| user. | A user was blocked by another user. | N | N |
| user. | A user changed their password. | N | N |
| user. | Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account. | N | N |
| user. | Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account. | N | N |
| user. | A new user account was created. | N | N |
| user. | A user secret for Codespaces was created. | N | N |
| user. | The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly. | N | N |
| user. | A user account was destroyed by an asynchronous job. | N | N |
| user. | A site administrator was demoted to an ordinary user account. | N | N |
| user. | A user deleted his or her account, triggering user.async_delete. | N | N |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | N | N | |
| user. | A user tried to sign in with an incorrect username, password, or two-factor authentication code. | N | N |
| user. | A user requested a password reset. | N | N |
| user. | N | N | |
| user. | A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden. | Y | N |
| user. | A user signed in. | Y | N |
| user. | A user signed out. | N | N |
| user. | A user signed in from a new device. | Y | N |
| user. | An ordinary user account was promoted to a site administrator. | N | N |
| user. | A user's account was restored. | N | N |
| user. | An email address was removed from a user account. | N | N |
| user. | A user secret for Codespaces was deleted. | N | N |
| user. | A username was changed. | N | N |
| user. | A user reset their account password. | N | N |
| user. | A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown. | Y | N |
| user. | A user signed in from an unrecognized device. | Y | N |
| user. | A user signed in from an unrecognized device and location. | N | N |
| user. | A user account was suspended. | N | N |
| user. | N | N | |
| user. | A 2FA challenge issued for a user account failed. | N | N |
| user. | A 2FA challenge issued for a user account succeeded. | Y | N |
| user. | A user used their 2FA recovery codes. | N | N |
| user. | A user downloaded 2FA recovery codes for their account. | N | N |
| user. | A user printed 2FA recovery codes for their account. | N | N |
| user. | A user viewed 2FA recovery codes for their account. | N | N |
| user. | A user was prompted for a two-factor authentication code. | Y | N |
| user. | A user was unblocked by another user. | N | N |
| user. | A user account was unsuspended. | N | N |
| user. | A user secret for Codespaces was updated. | N | N |
| user. | N | N |
user.add_email
#Description
An email address was added to a user account.
Documented on GitHub's user audit log reference.
user.async_delete
#Description
An asynchronous job was started to destroy a user account, eventually triggering a user.delete event.
Documented on GitHub's user audit log reference.
user.audit_log_export
#Description
Audit log entries were exported.
Documented on GitHub's user audit log reference.
user.block_user
#Description
A user was blocked by another user.
Documented on GitHub's user audit log reference.
user.change_password
#Description
A user changed their password.
Documented on GitHub's user audit log reference.
user.codespaces_trusted_repo_access_granted
#Description
Triggered when you allow the codespaces you create for a repository to access other repositories owned by your personal account.
Documented on GitHub's user audit log reference.
user.codespaces_trusted_repo_access_revoked
#Description
Triggered when you disallow the codespaces you create for a repository to access other repositories owned by your personal account.
Documented on GitHub's user audit log reference.
user.create
#Description
A new user account was created.
Documented on GitHub's user audit log reference.
user.create_integration_secret
#Description
A user secret for Codespaces was created.
Documented on GitHub's user audit log reference.
user.creation_rate_limit_exceeded
#Description
The rate of creation of user accounts, applications, issues, pull requests or other resources exceeded the configured rate limits, or too many users were followed too quickly.
Documented on GitHub's user audit log reference.
user.delete
#Description
A user account was destroyed by an asynchronous job.
Documented on GitHub's user audit log reference.
user.demote
#Description
A site administrator was demoted to an ordinary user account.
Documented on GitHub's user audit log reference.
user.destroy
#Description
A user deleted his or her account, triggering user.async_delete.
Documented on GitHub's user audit log reference.
user.device_verification_failure
#Documented on GitHub's user audit log reference.
user.device_verification_requested
#Documented on GitHub's user audit log reference.
user.device_verification_success
#Documented on GitHub's user audit log reference.
user.disable_collaborators_only
#Documented on GitHub's user audit log reference.
user.disable_contributors_only
#Documented on GitHub's user audit log reference.
user.disable_sockpuppet_disallowed
#Documented on GitHub's user audit log reference.
user.enable_collaborators_only
#Documented on GitHub's user audit log reference.
user.enable_contributors_only
#Documented on GitHub's user audit log reference.
user.enable_sockpuppet_disallowed
#Documented on GitHub's user audit log reference.
user.failed_login
#Description
A user tried to sign in with an incorrect username, password, or two-factor authentication code.
Documented on GitHub's user audit log reference.
user.forgot_password
#Description
A user requested a password reset.
Documented on GitHub's user audit log reference.
user.grant_github_developer
#Documented on GitHub's user audit log reference.
user.hide_private_contributions_count
#Description
A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now hidden.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1771366233250,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1Mg==",
"action": "user.hide_private_contributions_count",
"actor": "user",
"actor_id": 9000002,
"created_at": 1771366233250,
"operation_type": "modify",
"request_access_security_header": null,
"request_id": "C3E5:301921:81F488:AE7518:6994E759",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0",
"user_id": 9000002
}
References #
user.login
#Description
A user signed in.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1775065222215,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1Mw==",
"action": "user.login",
"actor": "user",
"actor_id": 9000002,
"created_at": 1775065222215,
"operation_type": "authentication",
"request_access_security_header": null,
"request_id": "E289:3D4446:F02F14:F18560:69CD587F",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
user.logout
#Description
A user signed out.
Documented on GitHub's user audit log reference.
user.new_device_used
#Description
A user signed in from a new device.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1775065213326,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1NA==",
"action": "user.new_device_used",
"actor": "user",
"actor_id": 9000002,
"created_at": 1775065213326,
"operation_type": "create",
"request_access_security_header": null,
"request_id": "E289:3D4446:EFF791:F14D50:69CD587C",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
user.promote
#Description
An ordinary user account was promoted to a site administrator.
Documented on GitHub's user audit log reference.
user.recreate
#Description
A user's account was restored.
Documented on GitHub's user audit log reference.
user.remove_email
#Description
An email address was removed from a user account.
Documented on GitHub's user audit log reference.
user.remove_integration_secret
#Description
A user secret for Codespaces was deleted.
Documented on GitHub's user audit log reference.
user.rename
#Description
A username was changed.
Documented on GitHub's user audit log reference.
user.reset_password
#Description
A user reset their account password.
Documented on GitHub's user audit log reference.
user.show_private_contributions_count
#Description
A user changed the visibility of their private contributions. The number of contributions to private repositories on the user's profile are now shown.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1770437779047,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1NQ==",
"action": "user.show_private_contributions_count",
"actor": "user",
"actor_id": 9000002,
"created_at": 1770437779047,
"operation_type": "modify",
"request_access_security_header": null,
"request_id": "F1A1:10B3E3:84D778:A9846E:6986BC7F",
"user": "user",
"user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1",
"user_id": 9000002
}
References #
user.sign_in_from_unrecognized_device
#Description
A user signed in from an unrecognized device.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1775065222200,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1Ng==",
"action": "user.sign_in_from_unrecognized_device",
"actor": "user",
"actor_id": 9000002,
"created_at": 1775065222200,
"operation_type": "authentication",
"request_access_security_header": null,
"request_id": "E289:3D4446:F02F14:F18560:69CD587F",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
user.sign_in_from_unrecognized_device_and_location
#Description
A user signed in from an unrecognized device and location.
Documented on GitHub's user audit log reference.
user.suspend
#Description
A user account was suspended.
Documented on GitHub's user audit log reference.
user.toggle_warn_private_email
#Documented on GitHub's user audit log reference.
user.two_factor_challenge_failure
#Description
A 2FA challenge issued for a user account failed.
Documented on GitHub's user audit log reference.
user.two_factor_challenge_success
#Description
A 2FA challenge issued for a user account succeeded.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1775065222158,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1Nw==",
"action": "user.two_factor_challenge_success",
"actor": "user",
"actor_id": 9000002,
"created_at": 1775065222158,
"operation_type": "authentication",
"request_access_security_header": null,
"request_id": "E289:3D4446:F02F14:F18560:69CD587F",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
user.two_factor_recover
#Description
A user used their 2FA recovery codes.
Documented on GitHub's user audit log reference.
user.two_factor_recovery_codes_downloaded
#Description
A user downloaded 2FA recovery codes for their account.
Documented on GitHub's user audit log reference.
user.two_factor_recovery_codes_printed
#Description
A user printed 2FA recovery codes for their account.
Documented on GitHub's user audit log reference.
user.two_factor_recovery_codes_viewed
#Description
A user viewed 2FA recovery codes for their account.
Documented on GitHub's user audit log reference.
user.two_factor_requested
#Description
A user was prompted for a two-factor authentication code.
Documented on GitHub's user audit log reference.Example Audit Log Entry #
{
"@timestamp": 1775065213402,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA1OA==",
"action": "user.two_factor_requested",
"actor": "user",
"actor_id": 9000002,
"created_at": 1775065213402,
"operation_type": "authentication",
"request_access_security_header": null,
"request_id": "E289:3D4446:EFF791:F14D50:69CD587C",
"user": "user",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0",
"user_id": 9000002
}
References #
user.unblock_user
#Description
A user was unblocked by another user.
Documented on GitHub's user audit log reference.
user.unsuspend
#Description
A user account was unsuspended.
Documented on GitHub's user audit log reference.
user.update_integration_secret
#Description
A user secret for Codespaces was updated.
Documented on GitHub's user audit log reference.
user.update_new_repository_default_branch_setting
#Documented on GitHub's user audit log reference.