{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/github-organization-audit-structured-actor-action-search/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/",
        "slug": "github-organization-audit-structured-actor-action-search",
        "url": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/github-organization-audit-structured-actor-action-search/"
        },
        "title": "Use structured actor and action filters in the GitHub organization audit log",
        "summary": "The organization audit log uses specific query qualifiers rather than ordinary free-text search.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:34+00:00",
        "modified_at": "2026-10-20T18:34:31+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 291,
        "potentially_affected": "This concerns the organization audit-log web query workflow. Knowing a person’s display name or an informal event description is not sufficient to establish a complete matching query.",
        "dse_recommendation": "DSE recommends translating an investigation question into exact account, repository and action identifiers before searching.",
        "primary_source": {
            "name": "GitHub — Reviewing the audit log for your organization",
            "url": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>The organization audit log uses specific query qualifiers rather than ordinary free-text search.</p>\n<h2>Source facts</h2>\n<p>GitHub states that audit-log entries cannot be searched using text. Queries instead use qualifiers such as actor, repo, action and operation. Actor searches require a GitHub username rather than the person’s real name, and repository searches require the account and repository name. Event names combine a category and operation, such as repo.create. The default view also has a narrower date range than the documented retained history.</p>\n<p>Source: <a href=\"https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization\">GitHub — Reviewing the audit log for your organization</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns the organization audit-log web query workflow. Knowing a person’s display name or an informal event description is not sufficient to establish a complete matching query.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends translating an investigation question into exact account, repository and action identifiers before searching. Keep the original question and the constructed qualifiers together in the evidence record. Check the intended event category rather than repeatedly trying prose variations that the interface does not support. Include the required time interval explicitly and assign an owner to investigate unresolved identity or event-name mappings. Keep the exact constructed query and its time reference in the investigation handoff. Ask another authorized reviewer to reproduce a known event from those notes, and record any unresolved username or action mapping as an evidence gap with an owner.</p>\n<h2>Verification</h2>\n<p>Proposed verification: use an authorized event with a known actor and repository to test each qualifier separately, then combine them. Compare the expected record with the returned fields and preserve the final query. Document a missing identifier or unavailable event category instead of concluding that no activity occurred from an unsuccessful text-style search.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization\">GitHub — Reviewing the audit log for your organization</a>. Reviewed October 20, 2026.</p>",
        "content_text": "The organization audit log uses specific query qualifiers rather than ordinary free-text search.\nSource facts\nGitHub states that audit-log entries cannot be searched using text. Queries instead use qualifiers such as actor, repo, action and operation. Actor searches require a GitHub username rather than the person’s real name, and repository searches require the account and repository name. Event names combine a category and operation, such as repo.create. The default view also has a narrower date range than the documented retained history.\nSource: GitHub — Reviewing the audit log for your organization.\nApplicability\nThis concerns the organization audit-log web query workflow. Knowing a person’s display name or an informal event description is not sufficient to establish a complete matching query.\nDSE recommendation\nDSE recommends translating an investigation question into exact account, repository and action identifiers before searching. Keep the original question and the constructed qualifiers together in the evidence record. Check the intended event category rather than repeatedly trying prose variations that the interface does not support. Include the required time interval explicitly and assign an owner to investigate unresolved identity or event-name mappings. Keep the exact constructed query and its time reference in the investigation handoff. Ask another authorized reviewer to reproduce a known event from those notes, and record any unresolved username or action mapping as an evidence gap with an owner.\nVerification\nProposed verification: use an authorized event with a known actor and repository to test each qualifier separately, then combine them. Compare the expected record with the returned fields and preserve the final query. Document a missing identifier or unavailable event category instead of concluding that no activity occurred from an unsuccessful text-style search.\nOfficial reference\nGitHub — Reviewing the audit log for your organization. Reviewed October 20, 2026.",
        "content_markdown": "The organization audit log uses specific query qualifiers rather than ordinary free-text search.\n\n## Source facts\n\nGitHub states that audit-log entries cannot be searched using text. Queries instead use qualifiers such as actor, repo, action and operation. Actor searches require a GitHub username rather than the person’s real name, and repository searches require the account and repository name. Event names combine a category and operation, such as repo.create. The default view also has a narrower date range than the documented retained history.\n\nSource: [GitHub — Reviewing the audit log for your organization](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization).\n\n## Applicability\n\nThis concerns the organization audit-log web query workflow. Knowing a person’s display name or an informal event description is not sufficient to establish a complete matching query.\n\n## DSE recommendation\n\nDSE recommends translating an investigation question into exact account, repository and action identifiers before searching. Keep the original question and the constructed qualifiers together in the evidence record. Check the intended event category rather than repeatedly trying prose variations that the interface does not support. Include the required time interval explicitly and assign an owner to investigate unresolved identity or event-name mappings. Keep the exact constructed query and its time reference in the investigation handoff. Ask another authorized reviewer to reproduce a known event from those notes, and record any unresolved username or action mapping as an evidence gap with an owner.\n\n## Verification\n\nProposed verification: use an authorized event with a known actor and repository to test each qualifier separately, then combine them. Compare the expected record with the returned fields and preserve the final query. Document a missing identifier or unavailable event category instead of concluding that no activity occurred from an unsuccessful text-style search.\n\n## Official reference\n\n[GitHub — Reviewing the audit log for your organization](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/",
                "url": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Use structured actor and action filters in the GitHub organization audit log",
                        "item": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/#article",
                "identifier": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/",
                "url": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/",
                "headline": "Use structured actor and action filters in the GitHub organization audit log",
                "description": "The organization audit log uses specific query qualifiers rather than ordinary free-text search.",
                "abstract": "The organization audit log uses specific query qualifiers rather than ordinary free-text search.",
                "articleBody": "The organization audit log uses specific query qualifiers rather than ordinary free-text search.\nSource facts\nGitHub states that audit-log entries cannot be searched using text. Queries instead use qualifiers such as actor, repo, action and operation. Actor searches require a GitHub username rather than the person’s real name, and repository searches require the account and repository name. Event names combine a category and operation, such as repo.create. The default view also has a narrower date range than the documented retained history.\nSource: GitHub — Reviewing the audit log for your organization.\nApplicability\nThis concerns the organization audit-log web query workflow. Knowing a person’s display name or an informal event description is not sufficient to establish a complete matching query.\nDSE recommendation\nDSE recommends translating an investigation question into exact account, repository and action identifiers before searching. Keep the original question and the constructed qualifiers together in the evidence record. Check the intended event category rather than repeatedly trying prose variations that the interface does not support. Include the required time interval explicitly and assign an owner to investigate unresolved identity or event-name mappings. Keep the exact constructed query and its time reference in the investigation handoff. Ask another authorized reviewer to reproduce a known event from those notes, and record any unresolved username or action mapping as an evidence gap with an owner.\nVerification\nProposed verification: use an authorized event with a known actor and repository to test each qualifier separately, then combine them. Compare the expected record with the returned fields and preserve the final query. Document a missing identifier or unavailable event category instead of concluding that no activity occurred from an unsuccessful text-style search.\nOfficial reference\nGitHub — Reviewing the audit log for your organization. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:34+00:00",
                "dateModified": "2026-10-20T18:34:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/github-organization-audit-structured-actor-action-search/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Use structured actor and action filters in the GitHub organization audit log"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 291,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub — Reviewing the audit log for your organization",
                    "url": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization"
                }
            }
        ]
    }
}