Skip to main content
Audit logs record nearly every action taken across an enterprise and its organizations. Use the Audit log to investigate activity, verify changes, and gather evidence for security or compliance workflows.

​
Where to find audit logs (UI)

Open your enterprise, go to Settings → Audit log. The Audit log lists events across the enterprise and its organizations. Each row shows a summary (actor, action, target, timestamp). Click the three-dot menu on any entry to view full metadata, including timestamp, action, actor and user IDs, enterprise/organization names and IDs, user agent, and more. Here’s an example of a detailed entry you might see in the UI:
A dark-mode GitHub Enterprise settings screen showing the Audit log with a left-hand Settings menu and a list of recent organization member invitation events. The top area shows a search/filter bar and export buttons for the log.

​
Filtering and searching the Audit log

Use the search bar to filter the Audit log by action, user, date range, or other indexed fields. Filters let you focus on a specific class of events (e.g., invites, repo creation, branch protection overrides). Common queries:
  • Organization member invitations:
  • Repositories created after a specific date:
  • Protected branch policy overrides:
When you run a query such as action:repo.create created:>2026-08-20, the results show who created each repository, when it was created, and other metadata. Example results might include repositories like .github, gists, guardrails, app-backend, and gh-actions.
A screenshot of a GitHub Enterprise "Audit log" page showing a list of recent repository creation events. The left side shows the settings menu and the main pane lists entries for repo.create actions.
Audit logs also record security-related actions. Use the protected_branch.policy_override filter to see who bypassed branch protections and when. In tightly controlled environments, these overrides are typically performed by a small set of admins — which will be visible in the returned events.
A dark-themed GitHub Enterprise "Audit log" settings page for the NextGen Gaming organization showing multiple protected_branch.policy_override events by the user "alice-admin-kk." The left sidebar displays settings items and the main panel lists the matched audit events with timestamps.

​
Useful filter cheat sheet

​
Programmatic access and exports

Audit logs can be consumed programmatically: Programmatic access enables automation (bulk export, scheduled retrieval, alerting integration) and long-term retention outside the UI.
Audit logs provide a full, timestamped record of enterprise and organization actions. Use UI filters for quick investigations and the API or log streaming to integrate audit records into centralized monitoring, alerting, and retention workflows.

​
References and further reading

Watch Video