Update audit log event data (#51284)

src/audit-logs/data/ghes-3.13/enterprise.json

@@ -84,6 +84,11 @@
     "description": "GitHub Advanced Security was disabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
   },
+  {
+    "action": "business_advanced_security.disabled_for_new_user_namespace_repos",
+    "description": "GitHub Advanced Security was disabled for new user namespace repositories in your enterprise.",
+    "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
+  },
   {
     "action": "business_advanced_security.enabled",
     "description": "GitHub Advanced Security was enabled for your enterprise.",
@@ -94,6 +99,11 @@
     "description": "GitHub Advanced Security was enabled for new repositories in your enterprise.",
     "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
   },
+  {
+    "action": "business_advanced_security.enabled_for_new_user_namespace_repos",
+    "description": "GitHub Advanced Security was enabled for new user namespace repositories in your enterprise.",
+    "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
+  },
   {
     "action": "business.advanced_security_policy_update",
     "description": "An enterprise owner created, updated, or removed a policy for GitHub Advanced Security.",
@@ -104,6 +114,16 @@
     "description": "N/A",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "business_advanced_security.user_namespace_repos_disabled",
+    "description": "GitHub Advanced Security was disabled for user namespace repositories in your enterprise.",
+    "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
+  },
+  {
+    "action": "business_advanced_security.user_namespace_repos_enabled",
+    "description": "GitHub Advanced Security was enabled for user namespace repositories in your enterprise.",
+    "docs_reference_links": "/admin/code-security/managing-github-advanced-security-for-your-enterprise/managing-github-advanced-security-features-for-your-enterprise"
+  },
   {
     "action": "business.clear_actions_settings",
     "description": "An enterprise owner or site administrator cleared GitHub Actions policy settings for an enterprise.",
@@ -389,6 +409,11 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "codespaces.start_environment",
+    "description": "A codespace was started.",
+    "docs_reference_links": "N/A"
+  },
   {
     "action": "codespaces.suspend_environment",
     "description": "A codespace was stopped.",
@@ -864,11 +889,21 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "integration.suspend",
+    "description": "A GitHub App was suspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
   {
     "action": "integration.transfer",
     "description": "Ownership of a GitHub App was transferred to another user or organization.",
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
   },
+  {
+    "action": "integration.unsuspend",
+    "description": "A GitHub App was unsuspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
   {
     "action": "ip_allow_list.disable",
     "description": "An IP allow list was disabled.",
@@ -1154,11 +1189,6 @@
     "description": "A user initiated a background job to delete an organization.",
     "docs_reference_links": "N/A"
   },
-  {
-    "action": "org.audit_log_export",
-    "description": "An export of the organization audit log was created. If the export included a query, the log will list the query used and the number of audit log entries matching that query.",
-    "docs_reference_links": "/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#exporting-the-audit-log"
-  },
   {
     "action": "org.billing_signup_error",
     "description": "N/A",
@@ -2114,6 +2144,26 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
   },
+  {
+    "action": "repo.code_scanning_third_party_tools_disabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
+  {
+    "action": "repo.code_scanning_third_party_tools_enabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
+  {
+    "action": "repo.codeql_advanced_disabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
+  {
+    "action": "repo.codeql_advanced_enabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
   {
     "action": "repo.codeql_disabled",
     "description": "Code scanning using the default setup was disabled for a repository.",
@@ -2574,6 +2624,11 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "secret_scanning_alert.validate",
+    "description": "A secret scanning alert was validated.",
+    "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+  },
   {
     "action": "secret_scanning.disable",
     "description": "Secret scanning was disabled for all existing repositories.",

src/audit-logs/data/ghes-3.13/organization.json

@@ -139,6 +139,11 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "codespaces.start_environment",
+    "description": "A codespace was started.",
+    "docs_reference_links": "N/A"
+  },
   {
     "action": "codespaces.suspend_environment",
     "description": "A codespace was stopped.",
@@ -159,6 +164,11 @@
     "description": "A commit comment was updated.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "copilot.access_revoked",
+    "description": "Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.",
+    "docs_reference_links": "N/A"
+  },
   {
     "action": "copilot.cfb_org_settings_changed",
     "description": "Copilot feature settings were changed at the organization level.",
@@ -209,6 +219,21 @@
     "description": "The excluded paths for GitHub Copilot were updated.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "copilot.knowledge_base_created",
+    "description": "A knowledge base was created in the organization.",
+    "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases"
+  },
+  {
+    "action": "copilot.knowledge_base_deleted",
+    "description": "A knowledge base was deleted from the organization.",
+    "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases"
+  },
+  {
+    "action": "copilot.knowledge_base_updated",
+    "description": "A knowledge base was updated in the organization.",
+    "docs_reference_links": "copilot/github-copilot-enterprise/copilot-chat-in-github/managing-copilot-knowledge-bases"
+  },
   {
     "action": "custom_hosted_runner.create",
     "description": "N/A",
@@ -559,11 +584,21 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "integration.suspend",
+    "description": "A GitHub App was suspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
   {
     "action": "integration.transfer",
     "description": "Ownership of a GitHub App was transferred to another user or organization.",
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
   },
+  {
+    "action": "integration.unsuspend",
+    "description": "A GitHub App was unsuspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
   {
     "action": "ip_allow_list.disable",
     "description": "An IP allow list was disabled.",
@@ -2174,6 +2209,26 @@
     "description": "A code scanning configuration for a branch of a repository was deleted.",
     "docs_reference_links": "/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch"
   },
+  {
+    "action": "repo.code_scanning_third_party_tools_disabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
+  {
+    "action": "repo.code_scanning_third_party_tools_enabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
+  {
+    "action": "repo.codeql_advanced_disabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
+  {
+    "action": "repo.codeql_advanced_enabled",
+    "description": "N/A",
+    "docs_reference_links": "N/A"
+  },
   {
     "action": "repo.codeql_disabled",
     "description": "Code scanning using the default setup was disabled for a repository.",
@@ -2794,6 +2849,11 @@
     "description": "A secret scanning alert was revoked.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "secret_scanning_alert.validate",
+    "description": "A secret scanning alert was validated.",
+    "docs_reference_links": "/code-security/secret-scanning/managing-alerts-from-secret-scanning"
+  },
   {
     "action": "secret_scanning.disable",
     "description": "Secret scanning was disabled for all existing repositories.",

src/audit-logs/data/ghes-3.13/user.json

@@ -134,6 +134,11 @@
     "description": "A codespace was restored.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "codespaces.start_environment",
+    "description": "A codespace was started.",
+    "docs_reference_links": "N/A"
+  },
   {
     "action": "codespaces.suspend_environment",
     "description": "A codespace was stopped.",
@@ -449,11 +454,21 @@
     "description": "Token(s) for a GitHub App were revoked.",
     "docs_reference_links": "N/A"
   },
+  {
+    "action": "integration.suspend",
+    "description": "A GitHub App was suspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
   {
     "action": "integration.transfer",
     "description": "Ownership of a GitHub App was transferred to another user or organization.",
     "docs_reference_links": "/apps/maintaining-github-apps/transferring-ownership-of-a-github-app"
   },
+  {
+    "action": "integration.unsuspend",
+    "description": "A GitHub App was unsuspended.",
+    "docs_reference_links": "/apps/maintaining-github-apps/suspending-a-github-app-installation"
+  },
   {
     "action": "marketplace_agreement_signature.create",
     "description": "The GitHub Marketplace Developer Agreement was signed.",

src/audit-logs/lib/config.json

@@ -3,5 +3,5 @@
     "apiOnlyEvents": "This event is not available in the web interface, only via the REST API, audit log streaming, or JSON/CSV exports.",
     "apiRequestEvent": "This event is only available via audit log streaming."
   },
-  "sha": "476743b7f0d4adcd4b825fb00ce54b76b2d623b5"
+  "sha": "2bc4c0cf2a3ac556565c1336dbaf3bf79cc97938"
 }