How to investigate GitHub organization audit logs

1. Know what the organization audit log contains

GitHub’s organization audit log records actions that affect the organization and identifies details such as the actor, action, time, affected user, and repository when applicable. Organization owners can search the log and GitHub Enterprise Cloud organizations can retrieve it through the audit log API.

This is not the same as repository contents, code-scanning alerts, a personal account security log, or an enterprise-wide audit stream. Keep those boundaries visible throughout the investigation.

GitHub reference: Reviewing the organization audit log

2. Bound the search with GitHub qualifiers

Begin with the organization, UTC time range, and strongest known field. GitHub supports qualifiers including actor, repo, action, operation, and created. Use the full owner/repository value for repository searches.

By default, GitHub displays recent events; older activity requires an explicit date range. Git event availability is shorter than other organization audit activity, so preserve relevant entries early.

3. Reconstruct the actor, action, and target

Actor?

Confirm the username or integration and whether it normally performs this action.

Action?

Record the exact category and operation rather than relying on a broad description.

Target?

Identify the organization, repository, team, member, application, or setting affected.

When?

Preserve exact UTC timestamps and inspect the sequence around the event.

Where?

Use available country or IP context carefully; GitHub does not disclose source IPs by default.

Intent?

Compare the action with pull requests, tickets, onboarding, offboarding, and owner confirmation.

4. Prioritize high-impact organization changes

• Membership and role changes: unexpected additions, removals, owner promotion, or team changes.
• Repository access changes: new collaborators, deploy keys, permission changes, or altered base permissions.
• Visibility and security settings: repositories made public or protections, scanning, and policies changed.
• Application permission changes: unfamiliar GitHub App access or authorization changes.
• Unusual sequences: a new actor followed by access expansion or repository-setting changes.

5. Keep collection limits separate from conclusions

GitHub documents up to 180 days for organization audit activity, while Git events are retained for seven days and require the REST API. Source IP visibility is optional and conditional. A missing field or event can reflect collection, feature, plan, or configuration limits—not proof that an action did not occur.

Preserve the original record, query, timestamps, actor, target, and related change references. Escalate unexplained access or security-setting changes through your incident process.

GitHub references: organization audit-log events and source IP visibility