Use structured actor and action filters in the GitHub organization audit log

The organization audit log uses specific query qualifiers rather than ordinary free-text search.

Source facts

GitHub states that audit-log entries cannot be searched using text. Queries instead use qualifiers such as actor, repo, action and operation. Actor searches require a GitHub username rather than the person’s real name, and repository searches require the account and repository name. Event names combine a category and operation, such as repo.create. The default view also has a narrower date range than the documented retained history.

Source: GitHub — Reviewing the audit log for your organization.

Applicability

This concerns the organization audit-log web query workflow. Knowing a person’s display name or an informal event description is not sufficient to establish a complete matching query.

DSE recommendation

DSE recommends translating an investigation question into exact account, repository and action identifiers before searching. Keep the original question and the constructed qualifiers together in the evidence record. Check the intended event category rather than repeatedly trying prose variations that the interface does not support. Include the required time interval explicitly and assign an owner to investigate unresolved identity or event-name mappings. Keep the exact constructed query and its time reference in the investigation handoff. Ask another authorized reviewer to reproduce a known event from those notes, and record any unresolved username or action mapping as an evidence gap with an owner.

Verification

Proposed verification: use an authorized event with a known actor and repository to test each qualifier separately, then combine them. Compare the expected record with the returned fields and preserve the final query. Document a missing identifier or unavailable event category instead of concluding that no activity occurred from an unsuccessful text-style search.

Official reference

GitHub — Reviewing the audit log for your organization. Reviewed October 20, 2026.