detection.wiki

Workflows

actionDescriptionSampleRule
workflows.actions_policy_violationA workflow run produced one or more workflow execution protection policy violations.NN
workflows.approve_workflow_jobA workflow job was approved.YN
workflows.bypass_protection_rulesNN
workflows.cancel_workflow_runA workflow run was cancelled.YN
workflows.comment_workflow_jobNN
workflows.completed_workflow_runA workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.YY
workflows.created_workflow_runA workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.YY
workflows.delete_workflow_runA workflow run was deleted.YN
workflows.disable_workflowA workflow was disabled.YN
workflows.enable_workflowA workflow was enabled, after previously being disabled by disable_workflow.YN
workflows.pin_workflowA workflow was pinned.YN
workflows.prepared_workflow_jobA workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.YN
workflows.reject_workflow_jobA workflow job was rejected.YN
workflows.rerun_workflow_runA workflow run was re-run.YN
workflows.unpin_workflowA workflow was unpinned after previously being pinned.YN

workflows.actions_policy_violation

#
Category
workflows

Description

A workflow run produced one or more workflow execution protection policy violations.

Documented on GitHub's enterprise audit log reference.

workflows.approve_workflow_job

#
Category
workflows

Description

A workflow job was approved.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000074,
  "actor_id": 9000155,
  "created_at": 1781788956486.0,
  "run_number": 8382.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "workflow_run_id": 9000423,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "workflows.approve_workflow_job",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000424,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.bypass_protection_rules

#
Category
workflows

Documented on GitHub's enterprise audit log reference.

workflows.cancel_workflow_run

#
Category
workflows

Description

A workflow run was cancelled.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000425,
  "actor_id": 9000068,
  "created_at": 1781752665577.0,
  "run_number": 11.0,
  "business_id": 9000005,
  "public_repo": false,
  "workflow_id": 9000426,
  "actor_is_bot": false,
  "workflow_run_id": 9000427,
  "org": "example-org",
  "name": "example-label-155",
  "repo": "user/example-repo",
  "actor": "user",
  "event": "dynamic",
  "action": "workflows.cancel_workflow_run",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "head_sha": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000428,
  "started_at": "2026-06-17T13:07:04.000-04:00",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "head_branch": "example-org-17/example-repo-192",
  "cancelled_at": "2026-06-17T23:17:45.000-04:00",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.comment_workflow_job

#
Category
workflows

Documented on GitHub's enterprise audit log reference.

workflows.completed_workflow_run

#
Category
workflows

Description

A workflow status changed to completed. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
action1 detection rulePanther
conclusion1 detection rulePanther
repo1 detection rulePanther

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000112,
  "actor_id": 9000113,
  "created_at": 1780430463849.0,
  "run_number": 14735.0,
  "trigger_id": 9000429,
  "business_id": 9000005,
  "public_repo": false,
  "run_attempt": 1.0,
  "workflow_id": 9000430,
  "actor_is_bot": false,
  "workflow_run_id": 9000431,
  "org": "example-org",
  "name": "example-label-153",
  "repo": "user/example-repo",
  "actor": "user",
  "event": "push",
  "topic": "example-label-132",
  "action": "workflows.completed_workflow_run",
  "business": "example-business",
  "head_sha": "gggggggggggggggggggggggggggggggggggggggg",
  "conclusion": "success",
  "started_at": "2026-06-02T19:59:13.000Z",
  "head_branch": "master",
  "completed_at": "2026-06-02T20:01:03.000Z",
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

References #

workflows.created_workflow_run

#
Category
workflows

Description

A workflow run was create. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.

Documented on GitHub's enterprise audit log reference.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
action1 detection rulePanther
actor1 detection rulePanther
event1 detection rulePanther
programmatic_access_type1 detection rulePanther

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000009,
  "actor_id": 9000432,
  "token_id": 9000433,
  "created_at": 1781720198817.0,
  "run_number": 14246.0,
  "trigger_id": 9000434,
  "business_id": 9000005,
  "public_repo": true,
  "workflow_id": 9000435,
  "actor_is_bot": false,
  "workflow_run_id": 9000436,
  "org": "example-org",
  "name": "example-label-130",
  "repo": "user/example-repo",
  "actor": "user",
  "event": "pull_request",
  "action": "workflows.created_workflow_run",
  "business": "example-business",
  "head_sha": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000437,
  "started_at": "2026-06-17T18:16:38.000Z",
  "user_agent": "launch/example-label-96",
  "head_branch": "example-branch-16",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAyOA==",
  "operation_type": "create",
  "external_identity_nameid": "user",
  "programmatic_access_type": "GitHub App server-to-server token",
  "external_identity_username": "user"
}

The Detection Fields above are rule-derived rather than a complete schema: a sampled record can carry fewer keys than documented, and can carry keys GitHub does not document. See the audit log event model for what determines which fields a given record carries.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

  • GitHub Workflow Dispatched by GitHub Actions Bot source informational: Detects when a GitHub App server-to-server token (GITHUB_TOKEN) triggers a workflow manually through the workflow_dispatch event, creating a new workflow run. This activity may indicate that a possibly previously exfiltrated GITHUB_TOKEN was subsequently used to authenticate to the GitHub REST API to trigger a workflow manually. This technique has been observed as the last step in the attack chain of the Nx/S1ngularity supply chain attack.T1195

References #

workflows.delete_workflow_run

#
Category
workflows

Description

A workflow run was deleted.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000286,
  "actor_id": 9000438,
  "created_at": 1785275557194.0,
  "run_number": 18572.0,
  "trigger_id": 9000439,
  "business_id": 9000005,
  "public_repo": false,
  "workflow_id": 9000440,
  "actor_is_bot": false,
  "workflow_run_id": 9000441,
  "org": "example-org",
  "name": "example-label-154",
  "repo": "user/example-repo",
  "actor": "user",
  "event": "pull_request",
  "action": "workflows.delete_workflow_run",
  "business": "example-business",
  "head_sha": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000442,
  "started_at": "2026-07-28T17:49:53.000-04:00",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "head_branch": "example-branch-17",
  "operation_type": "remove",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.disable_workflow

#
Category
workflows

Description

A workflow was disabled.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000268,
  "actor_id": 9000443,
  "created_at": 1780317574208.0,
  "business_id": 9000005,
  "public_repo": false,
  "workflow_id": 9000444,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "workflows.disable_workflow",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000445,
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.enable_workflow

#
Category
workflows

Description

A workflow was enabled, after previously being disabled by disable_workflow.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000446,
  "actor_id": 9000343,
  "created_at": 1781784727888.0,
  "business_id": 9000005,
  "public_repo": false,
  "workflow_id": 9000447,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "workflows.enable_workflow",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000448,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.pin_workflow

#
Category
workflows

Description

A workflow was pinned.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000323,
  "actor_id": 9000449,
  "created_at": 1782749615107.0,
  "business_id": 9000005,
  "public_repo": false,
  "workflow_id": 9000450,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "workflows.pin_workflow",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000451,
  "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.prepared_workflow_job

#
Category
workflows

Description

A workflow job was started. Includes the list of secrets that were provided to the job. This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000009,
  "runner_id": 9000452,
  "created_at": 1780426002006.0,
  "business_id": 9000005,
  "runner_group_id": 9000453,
  "workflow_run_id": 9000454,
  "is_hosted_runner": true,
  "org": "example-org",
  "repo": "user/example-repo",
  "action": "workflows.prepared_workflow_job",
  "business": "example-business",
  "job_name": "example-label-151",
  "runner_name": "example-label-152",
  "runner_labels": [
    "ubuntu-latest"
  ],
  "operation_type": "modify",
  "environment_name": "",
  "job_workflow_ref": "example-business-1/example-repo-38/.github/workflows/example.invalid@refs/heads/gh-readonly-queue/main/pr-7724-gggggggggggggggggggggggggggggggggggggggg",
  "runner_group_name": "example-label-106",
  "runner_owner_type": "Enterprise"
}

References #

workflows.reject_workflow_job

#
Category
workflows

Description

A workflow job was rejected.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000455,
  "actor_id": 9000063,
  "created_at": 1784650352078.0,
  "run_number": 306.0,
  "business_id": 9000005,
  "public_repo": false,
  "actor_is_bot": false,
  "workflow_run_id": 9000456,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "workflows.reject_workflow_job",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000457,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.rerun_workflow_run

#
Category
workflows

Description

A workflow run was re-run.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000002,
  "repo_id": 9000458,
  "actor_id": 9000459,
  "created_at": 1780780436948.0,
  "run_number": 305.0,
  "trigger_id": 9000460,
  "business_id": 9000005,
  "public_repo": false,
  "run_attempt": 2.0,
  "workflow_id": 9000461,
  "actor_is_bot": false,
  "check_run_id": 9000462,
  "workflow_run_id": 9000463,
  "org": "example-org",
  "name": "example-label-156",
  "repo": "user/example-repo",
  "actor": "user",
  "event": "pull_request",
  "action": "workflows.rerun_workflow_run",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "head_sha": "gggggggggggggggggggggggggggggggggggggggg",
  "request_id": 9000464,
  "rerun_type": "single_job",
  "started_at": "2026-06-06T17:13:56.000-04:00",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "head_branch": "example-branch-18",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #

workflows.unpin_workflow

#
Category
workflows

Description

A workflow was unpinned after previously being pinned.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000320,
  "actor_id": 9000321,
  "created_at": 1780495086597.0,
  "business_id": 9000005,
  "public_repo": false,
  "workflow_id": 9000465,
  "actor_is_bot": false,
  "org": "example-org",
  "repo": "user/example-repo",
  "actor": "user",
  "action": "workflows.unpin_workflow",
  "actor_ip": "ip-redacted",
  "business": "example-business",
  "request_id": 9000466,
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ip-redacted Safari/537.36",
  "actor_location": {
    "country_code": "XX"
  },
  "operation_type": "modify",
  "external_identity_nameid": "user",
  "external_identity_username": "user"
}

References #