> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/github/audit-log.md).
# Audit Log
The **Audit Log** page shows your GitHub organization's audit log activity inside StepSecurity. Use it to see what happened in the organization, which personal access tokens made calls and from where, and which workflow runs were deleted and by whom.
To open it, select **Audit Log** in the **GitHub** section of the left navigation.
StepSecurity refreshes audit log activity every fifteen minutes and keeps events for 10 days.
{% hint style="info" %}
This page shows events from GitHub's audit log for your organization. For a record of actions taken in the StepSecurity console, see [Audit Logs](/administration/admin-console/audit-logs.md) in the Admin Console.
{% endhint %}
The page has three tabs: **All activity**, **PAT activity**, and **Deleted runs**.
### All activity
The **All activity** tab lists every event GitHub recorded for the organization, newest first.
For each event, StepSecurity shows:
* **Time (GMT)**: when the event occurred
* **User**: the account that performed the action, such as a user or a GitHub App bot
* **Action**: the GitHub audit log action, for example `workflows.completed_workflow_run` or `org.register_self_hosted_runner`
* **Repository**: the repository the event relates to, if any
* **Source**: how the action was performed, for example **Web** or **GitHub App**
* **Location**: the actor's country and IP address, when GitHub reports them
Use the search box to find specific events. Select **PAT activity** or **Deleted runs** next to the search box to narrow the list to calls made with a personal access token or to deleted workflow runs. When the list is narrowed to PAT activity, a **Token** column shows which token made each call.
### PAT activity
The **PAT activity** tab summarizes calls made with personal access tokens: which token, by whom, and from where.
For each token, StepSecurity shows:
* **Token**: the token name and class (fine-grained or classic PAT), and scopes for classic PATs
* **User**: the token owner
* **Calls**: the number of calls the token made in the retention window
* **Last seen (GMT)**: the time of the token's most recent call
* **Locations**: the countries the token was used from, with call counts
* **Baseline**: the token's learned hourly rate, or **not learned yet** while it is still learning
* **Detections**: any [PAT Abuse](/workspace/detections.md#pat-abuse) detections raised for the token
A token that made calls but is not in your [Apps & PATs](/github/apps-and-pats.md) inventory is shown as **Not identified** with a **Not in inventory** badge.
Expand a row to see more about the token:
* **Recorded**: the number of calls, repositories, and IP addresses, the first and last call times, and the actions the token performed most often, with counts
* **Learned baseline**: the baseline the PAT Abuse rules compare the token's activity against, or a note that it has not been learned yet
* **Detections**: the PAT Abuse detections raised for the token in the retention window
* The individual events for the token, with time, user, token, action, repository, and location
The baselines on this tab are the same ones the PAT Abuse rules use. To change how baselines are learned and when a rule raises a detection, see [Configuring detection thresholds](/workspace/detections.md#configuring-detection-thresholds).
### Deleted runs
The **Deleted runs** tab shows workflow runs deleted from the organization's repositories, and who deleted them.
The tab shows:
* Counters for **Runs deleted**, **Repositories**, **Users**, and **Workflows**
* A breakdown of deleted runs **By repository**, **By user**, and **By workflow**
* A list of deleted runs with the time, the user who deleted the run, the repository, the workflow (with its branch and trigger event), and a link to the run
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.stepsecurity.io/github/audit-log.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
