> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Analyze audit logs

> Guide to viewing, filtering, and exporting GitHub Enterprise audit logs for investigating actions, monitoring security and compliance, and integrating logs via API or streaming

Audit logs record nearly every action taken across an enterprise and its organizations. Use the Audit log to investigate activity, verify changes, and gather evidence for security or compliance workflows.

## Where to find audit logs (UI)

Open your enterprise, go to **Settings → Audit log**. The Audit log lists events across the enterprise and its organizations. Each row shows a summary (actor, action, target, timestamp). Click the three-dot menu on any entry to view full metadata, including timestamp, action, actor and user IDs, enterprise/organization names and IDs, user agent, and more.

Here’s an example of a detailed entry you might see in the UI:

```text theme={null}
alice-admin-kk – business.add_support_entitlee
Added support entitlement for kabir-dev1-kk in the NextGen Gaming enterprise
India | 13 minutes ago ...
@timestamp 2026-08-25 13:09:17 +0530
_document_id 369cz2fR_BUqVk0pWcWGZA
action business.add_support_entitlee
actor alice-admin-kk
actor_id 319981142
actor_is_bot false
business nextgen-gaming
business_id 772436
created_at 2026-08-25 13:09:17 +0530
name NextGen Gaming
operation_type create
request_access_security_header nil
request_id 1484:7993E:4CA9166:58E64BE:6A8D46A2
user kabir-dev1-kk
user_agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0
user_id 319983216

alice-admin-kk – org.invite_member
Invited siddharth.gh900+DEV2@gmail.com to the game-devstudio organization reinstating the previous role
United States | 32 minutes ago
▸ View SSO details

alice-admin-kk – org.remove_member
sid-dev2-kk was removed from the game-devstudio organization
United States | 33 minutes ago
▸ View SSO details

alice-admin-kk – personal_access_token.access_revoked
alice-admin-kk has revoked access to resources owned by game-devstudio for the personal access token "fine-grained-token-test"
United States | 33 minutes ago
▸ View SSO details
```

![A dark-mode GitHub Enterprise settings screen showing the Audit log with a left-hand Settings menu and a list of recent organization member invitation events. The top area shows a search/filter bar and export buttons for the log.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Analyze-audit-logs/github-enterprise-audit-invite-events.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=529e3e696182825cc3b1545cd157f186)

## Filtering and searching the Audit log

Use the search bar to filter the Audit log by action, user, date range, or other indexed fields. Filters let you focus on a specific class of events (e.g., invites, repo creation, branch protection overrides).

Common queries:

* Organization member invitations:

```text theme={null}
action:org.invite_member
```

* Repositories created after a specific date:

```text theme={null}
action:repo.create created:>2026-08-20
```

* Protected branch policy overrides:

```text theme={null}
action:protected_branch.policy_override
```

When you run a query such as `action:repo.create created:>2026-08-20`, the results show who created each repository, when it was created, and other metadata. Example results might include repositories like `.github`, `gists`, `guardrails`, `app-backend`, and `gh-actions`.

![A screenshot of a GitHub Enterprise "Audit log" page showing a list of recent repository creation events. The left side shows the settings menu and the main pane lists entries for repo.create actions.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Analyze-audit-logs/github-enterprise-audit-log-repo-create.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=4a2e7039f1915ebb1743660fa472dc5d)

Audit logs also record security-related actions. Use the `protected_branch.policy_override` filter to see who bypassed branch protections and when. In tightly controlled environments, these overrides are typically performed by a small set of admins — which will be visible in the returned events.

![A dark-themed GitHub Enterprise "Audit log" settings page for the NextGen Gaming organization showing multiple protected\_branch.policy\_override events by the user "alice-admin-kk." The left sidebar displays settings items and the main panel lists the matched audit events with timestamps.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-Analyze-audit-logs/nextgen-gaming-auditlog-protected-branch.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=ff9a0f3a88794ac99228d86bad5fa3ed)

## Useful filter cheat sheet

| Use case | Example query |
| - | - |
| Organization invitations | `action:org.invite_member` |
| Files a repository was created on or after a date | `action:repo.create created:>2026-08-20` |
| Branch protection overrides | `action:protected_branch.policy_override` |
| Actions by a specific user | `actor:alice-admin-kk` |
| All actions in an organization | `org:game-devstudio` |

## Programmatic access and exports

Audit logs can be consumed programmatically:

* Use the Enterprise Audit Log REST API: [https://docs.github.com/en/rest/enterprise-admin/audit-log](https://docs.github.com/en/rest/enterprise-admin/audit-log)
* For continuous integration with SIEM or centralized logging, configure log streaming / exports: [https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-your-enterprise/exporting-your-enterprise-audit-log](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-your-enterprise/exporting-your-enterprise-audit-log)

Programmatic access enables automation (bulk export, scheduled retrieval, alerting integration) and long-term retention outside the UI.

Audit logs provide a full, timestamped record of enterprise and organization actions. Use UI filters for quick investigations and the API or log streaming to integrate audit records into centralized monitoring, alerting, and retention workflows.

## References and further reading

* [Enterprise audit log REST API](https://docs.github.com/en/rest/enterprise-admin/audit-log)
* [Exporting your enterprise audit log (log streaming)](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-your-enterprise/exporting-your-enterprise-audit-log)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/ddb3d739-d57f-4374-b851-69bb14cbeb8b/lesson/dce7ecc1-43f5-4221-86f9-8bd6e3377c2d)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.