Audit Log

The Audit Log page shows your GitHub organization's audit log activity inside StepSecurity. Use it to see what happened in the organization, which personal access tokens made calls and from where, and which workflow runs were deleted and by whom.

To open it, select Audit Log in the GitHub section of the left navigation.

StepSecurity refreshes audit log activity every fifteen minutes and keeps events for 10 days.

This page shows events from GitHub's audit log for your organization. For a record of actions taken in the StepSecurity console, see Audit Logs in the Admin Console.

The page has three tabs: All activity, PAT activity, and Deleted runs.

All activity

The All activity tab lists every event GitHub recorded for the organization, newest first.

For each event, StepSecurity shows:

• Time (GMT): when the event occurred
• User: the account that performed the action, such as a user or a GitHub App bot
• Action: the GitHub audit log action, for example workflows.completed_workflow_run or org.register_self_hosted_runner
• Repository: the repository the event relates to, if any
• Source: how the action was performed, for example Web or GitHub App
• Location: the actor's country and IP address, when GitHub reports them

Use the search box to find specific events. Select PAT activity or Deleted runs next to the search box to narrow the list to calls made with a personal access token or to deleted workflow runs. When the list is narrowed to PAT activity, a Token column shows which token made each call.

PAT activity

The PAT activity tab summarizes calls made with personal access tokens: which token, by whom, and from where.

For each token, StepSecurity shows:

• Token: the token name and class (fine-grained or classic PAT), and scopes for classic PATs
• User: the token owner
• Calls: the number of calls the token made in the retention window
• Last seen (GMT): the time of the token's most recent call
• Locations: the countries the token was used from, with call counts
• Baseline: the token's learned hourly rate, or not learned yet while it is still learning
• Detections: any PAT Abuse detections raised for the token

A token that made calls but is not in your Apps & PATs inventory is shown as Not identified with a Not in inventory badge.

Expand a row to see more about the token:

• Recorded: the number of calls, repositories, and IP addresses, the first and last call times, and the actions the token performed most often, with counts
• Learned baseline: the baseline the PAT Abuse rules compare the token's activity against, or a note that it has not been learned yet
• Detections: the PAT Abuse detections raised for the token in the retention window
• The individual events for the token, with time, user, token, action, repository, and location

The baselines on this tab are the same ones the PAT Abuse rules use. To change how baselines are learned and when a rule raises a detection, see Configuring detection thresholds.

Deleted runs

The Deleted runs tab shows workflow runs deleted from the organization's repositories, and who deleted them.

The tab shows:

• Counters for Runs deleted, Repositories, Users, and Workflows
• A breakdown of deleted runs By repository, By user, and By workflow
• A list of deleted runs with the time, the user who deleted the run, the repository, the workflow (with its branch and trigger event), and a link to the run