Feedback Request: Github Audit Logs

[julieagnessparks]

While writing security detections on the Github Enterprise Audit Logs, I've noted some feedback on areas to expand or improve the current logging.

• In the integration_installation.repositories_added log, there is a field repository_selection that lists “all” but it would be helpful for security detections to have the repositories listed in this field.
• There are no source IP/actor_ip addresses captured for all actions taken, only the actor_location. It would be more helpful to have IP, country, state for context.
• oauth_application_id is often an empty field. oauth related name and ID should be included in all oauth type audit logs.

[boylejj]

@julieagnessparks... Thank you for the feedback.

• integration_installation.repositories_added has been added to our black log and will be assessed and prioritized. We have received this requests from other customers as well.
• IP/actor_ip address being displayed in the audit log was recent shipped and is generally available. Please see this changelog post, as it is an opt in feature.
• We have received quite a bit of feedback relating to authentication data and how it relates to the audit log. We have some exciting functionality in the works that should improve the experience you've noted. I'll link a public roadmap link here once it is available so you can track the work.

[boylejj]

Displaying PAT and OAuth authentication data for audit log events: github/roadmap#544