Project
| action | Description | Sample | Rule |
|---|---|---|---|
| project. | A project board visibility was changed. | N | N |
| project. | A project board was closed. | Y | N |
| project. | A project board was created. | Y | N |
| project. | A project board was deleted. | N | Y |
| project. | A repository was linked to a project board. | N | N |
| project. | A project board was reopened. | Y | N |
| project. | A project board was renamed. | N | N |
| project. | A repository was unlinked from a project board. | N | N |
| project. | The project's base-level permission for all organization members was changed or removed. | N | N |
| project. | A team's project board permission level was changed or when a team was added or removed from a project board. | N | N |
| project. | A user was added to or removed from a project board or had their permission level changed. | N | Y |
| project. | A project's visibility was changed from public to private. | Y | N |
| project. | A project's visibility was changed from private to public. | Y | N |
project.access
#Description
A project board visibility was changed.
Documented on GitHub's enterprise audit log reference.
project.close
#Description
A project board was closed.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783955178989,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDM=",
"action": "project.close",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955178989,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"project_id": 9000007,
"project_kind": "MemexProject",
"project_name": "dw-harn-renamed",
"public_project": false,
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0CD37:F2CA191:6A54FEEA",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
project.create
#Description
A project board was created.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783955177046,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDc=",
"action": "project.create",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955177046,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "create",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0C184:F2C95A7:6A54FEE8",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
project.delete
#Description
A project board was deleted.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Sigma Detection Rules #
Sigma #
T1213, T1213.003
project.link
#Description
A repository was linked to a project board.
Documented on GitHub's enterprise audit log reference.
project.open
#Description
A project board was reopened.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783955179386,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDI=",
"action": "project.open",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955179386,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"project_id": 9000007,
"project_kind": "MemexProject",
"project_name": "dw-harn-renamed",
"public_project": false,
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0CF81:F2CA3EE:6A54FEEB",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
project.rename
#Description
A project board was renamed.
Documented on GitHub's enterprise audit log reference.
project.unlink
#Description
A repository was unlinked from a project board.
Documented on GitHub's enterprise audit log reference.
project.update_org_permission
#Description
The project's base-level permission for all organization members was changed or removed.
Documented on GitHub's enterprise audit log reference.
project.update_team_permission
#Description
A team's project board permission level was changed or when a team was added or removed from a project board.
Documented on GitHub's enterprise audit log reference.
project.update_user_permission
#Description
A user was added to or removed from a project board or had their permission level changed.
Documented on GitHub's enterprise audit log reference. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors action1 detection rule Sigma Detection Rules #
Sigma #
T1098, T1098.001, T1098.003, T1213, T1213.003
project.visibility_private
#Description
A project's visibility was changed from public to private.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783955178548,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDQ=",
"action": "project.visibility_private",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955178548,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"project_id": 9000007,
"project_kind": "MemexProject",
"project_name": "dw-harn-renamed",
"public_project": false,
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0CB65:F2C9FBE:6A54FEEA",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}
project.visibility_public
#Description
A project's visibility was changed from private to public.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"@timestamp": 1783955178106,
"_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwMDU=",
"action": "project.visibility_public",
"actor": "user",
"actor_id": 9000002,
"actor_is_bot": false,
"actor_location": {
"country_code": "XX"
},
"business": "example-business",
"business_id": 9000003,
"created_at": 1783955178106,
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
"operation_type": "modify",
"org": "example-org",
"org_id": 9000004,
"programmatic_access_type": "Personal access token (classic)",
"project_id": 9000007,
"project_kind": "MemexProject",
"project_name": "dw-harn-renamed",
"public_project": true,
"request_access_security_header": null,
"request_id": "94CE:3FE560:EE0C8C9:F2C9D2C:6A54FEE9",
"token_id": 9000006,
"token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
"user_agent": "python-requests/2.34.2"
}