Enterprise
| action | Description | Sample | Rule |
|---|---|---|---|
| enterprise. | A new just-in-time GitHub Actions self-hosted runner was configured | N | N |
| enterprise. | A new GitHub Actions self-hosted runner was registered. | Y | Y |
| enterprise. | A GitHub Actions self-hosted runner was removed. | N | N |
| enterprise. | A GitHub Actions self-hosted runner group was created. | N | N |
| enterprise. | A GitHub Actions self-hosted runner group was removed. | N | N |
| enterprise. | A GitHub Actions self-hosted runner group was renamed. | N | N |
| enterprise. | The REST API was used to remove a GitHub Actions self-hosted runner from a group. | N | N |
| enterprise. | A GitHub Actions self-hosted runner was added to a group. | N | N |
| enterprise. | A GitHub Actions runner group's list of members was updated. | N | N |
| enterprise. | The configuration of a GitHub Actions self-hosted runner group was changed. | N | N |
| enterprise. | The visibility of a GitHub Actions self-hosted runner group was updated via the REST API. | N | N |
| enterprise. | The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports. | N | N |
| enterprise. | The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports. | N | N |
| enterprise. | The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export. | N | N |
enterprise.configure_self_hosted_jit_runner
#Description
A new just-in-time GitHub Actions self-hosted runner was configured
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.register_self_hosted_runner
#Description
A new GitHub Actions self-hosted runner was registered.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Splunk event.action1 detection rule Elastic event.category1 detection rule Elastic Example Audit Log Entry #
{
"@timestamp": 1736846446162,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDA2Mg==",
"action": "enterprise.register_self_hosted_runner",
"actor": "entadmin01",
"actor_id": 9000003,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9500001,
"created_at": 1736846446162,
"operation_type": "create",
"request_access_security_header": null,
"user_agent": "GitHubActionsRunner-linux-x64/2.321.0 ClientId/00000000-0000-0000-0000-000000000000 CommitSHA/e249007931b7c8e857797fa259c167f0bd4f997a Pid/266051 CreationTime/2025-01-14T09%3A20%3A45.5913104Z (Runner)"
}
Detection Rules #
Elastic #
T1195, T1195.001, T1195.002Splunk #
T1195, T1685References #
enterprise.remove_self_hosted_runner
#Description
A GitHub Actions self-hosted runner was removed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_created
#Description
A GitHub Actions self-hosted runner group was created.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_removed
#Description
A GitHub Actions self-hosted runner group was removed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_renamed
#Description
A GitHub Actions self-hosted runner group was renamed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_runner_removed
#Description
The REST API was used to remove a GitHub Actions self-hosted runner from a group.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_runners_added
#Description
A GitHub Actions self-hosted runner was added to a group.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_runners_updated
#Description
A GitHub Actions runner group's list of members was updated.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_updated
#Description
The configuration of a GitHub Actions self-hosted runner group was changed.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.runner_group_visiblity_updated
#Description
The visibility of a GitHub Actions self-hosted runner group was updated via the REST API.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.self_hosted_runner_offline
#Description
The GitHub Actions runner application was stopped. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.self_hosted_runner_online
#Description
The GitHub Actions runner application was started. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
enterprise.self_hosted_runner_updated
#Description
The GitHub Actions runner application was updated. This event is not included in the JSON/CSV export.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.