Reviewing your security log

Accessing your security log

The security log lists all actions performed within the last 90 days.

1. Klicke in der oberen rechten Ecke einer beliebigen Seite auf Dein Profilfoto und klicke dann auf Settings (Einstellungen).

   

2. In the user settings sidebar, click Security log.

   

Searching your security log

Das Protokoll enthält die folgenden Informationen zu jeder Aktion:

• an welchem Repository eine Aktion durchgeführt wurde,
• der Benutzer, der die Aktion durchgeführt hat
• die Aktion, die durchgeführt wurde,
• in welchem Land die Aktion durchgeführt wurde,
• Datum und Uhrzeit der Aktion.

Beachte, dass Du nicht mit Text nach Einträgen suchen kannst. Du kannst jedoch Suchabfragen mit den verschiedensten Filtern erstellen. Viele Operatoren, die für die Abfrage des Log verwendet werden - wie z.B. -, > oder < - haben das gleiche Format wie die Suche über GitHub. Weitere Informationen findest Du unter „Suchen nach GitHub.“

Vorgangsbasierte Suche

Verwende den Qualifizierer operation (Vorgang) um Aktionen für spezifische Typen von Vorgängen zu beschränken. Ein Beispiel:

• operation:access (Vorgangszugriffe) findet alle Ereignisse, bei denen auf eine Ressource zugegriffen wurde.
• operation:authentication (Vorgangsauthentifizierung) findet alle Ereignisse, bei denen ein Authentifizierungsereignis durchgeführt wurde.
• operation:create (Vorgangserstellung) findet alle Ereignisse, bei denen eine Ressource erstellt wurde.
• operation:modify (Vorgangsveränderung) findet alle Ereignisse, bei denen eine vorhandene Ressource verändert wurde.
• operation:remove (Vorgangsentfernung) findet alle Ereignisse, bei denen eine vorhandene Ressource entfernt wurde.
• operation:restore (Vorgangswiederherstellung) findet alle Ereignisse, bei denen eine vorhandene Ressource wiederhergestellt wurde.
• operation:transfer (Vorgangsübertragung) findet alle Ereignisse, bei denen eine vorhandene Ressource übertragen wurde.

Suche basierend auf Repository

Verwende den Qualifizierer repo (Repository) um Aktionen auf ein spezifisches Repository einzuschränken. Ein Beispiel:

• repo:my-org/our-repo findet alle Ereignisse, die im Repository our-repo der Organisation my-org aufgetreten sind.
• repo:my-org/our-repo repo:my-org/another-repo findet alle Ereignisse, die in den Repositorys our-repo und another-repo der Organisation my-org aufgetreten sind.
• -repo:my-org/not-this-repo schließt alle Ereignisse aus, die im Repository not-this-repo der Organisation my-org aufgetreten sind.

Beachte, dass Du den Kontonamen im Qualifizierer repo einfügen musst; nur nach repo:our-repo zu suchen, wird nicht funktionieren.

Suche nach Benutzer

Der Qualifizierer actor (Akteur) kann Ereignisse einschränken basierend darauf, wer die Aktion durchgeführt hat. Ein Beispiel:

• actor:octocat findet alle Ereignisse in Verbindung mit Aktionen, die von octocat ausgeführt wurden.
• actor:octocat actor:hubot findet alle Ereignisse in Verbindung mit Aktionen, die von octocat oder hubot ausgeführt wurden.
• -actor:hubot schließt alle Ereignisse in Verbindung mit Aktionen aus, die von hubot ausgeführt wurden.

Beachten Sie, dass Sie nur den in GitHub verwendeten Benutzernamen, nicht den wirklichen Namen eines Benutzers, verwenden können.

Search based on the action performed

Category Name	Description
account_recovery_token	Contains all activities related to adding a recovery token.
billing	Contains all activities related to your billing information.
marketplace_agreement_signature	Contains all activities related to signing the GitHub Marketplace Developer Agreement.
marketplace_listing	Contains all activities related to listing apps in GitHub Marketplace.
oauth_access	Contains all activities related to OAuth Apps you've connected with.
payment_method	Contains all activities related to paying for your GitHub subscription.
profile_picture	Contains all activities related to your profile picture.
project	Contains all activities related to project boards.
public_key	Contains all activities related to your public SSH keys.
repo	Contains all activities related to the repositories you own.
sponsors	Contains all events related to GitHub Sponsors and sponsor buttons (see "About GitHub Sponsors" and "Displaying a sponsor button in your repository")
two_factor_authentication	Contains all activities related to two-factor authentication.
user	Contains all activities related to your account.

A description of the events within these categories is listed below.

The account_recovery_token category

Action	Description
confirm	Triggered when you successfully store a new token with a recovery provider.
recover	Triggered when you successfully redeem an account recovery token.
recover_error	Triggered when a token is used but GitHub is not able to validate it.

The billing category

Action	Description
change_billing_type	Triggered when you change how you pay for GitHub.
change_email	Triggered when you change your email address.

The marketplace_agreement_signature category

Action	Description
create	Triggered when you sign the GitHub Marketplace Developer Agreement.

The marketplace_listing category

Action	Description
approve	Triggered when your listing is approved for inclusion in GitHub Marketplace.
create	Triggered when you create a listing for your app in GitHub Marketplace.
delist	Triggered when your listing is removed from GitHub Marketplace.
redraft	Triggered when your listing is sent back to draft state.
reject	Triggered when your listing is not accepted for inclusion in GitHub Marketplace.

The oauth_access category

Action	Description
create	Triggered when you grant access to an OAuth App.
destroy	Triggered when you revoke an OAuth App's access to your account.

The payment_method category

Action	Description
clear	Triggered when a payment method on file is removed.
create	Triggered when a new payment method is added, such as a new credit card or PayPal account.
update	Triggered when an existing payment method is updated.

The profile_picture category

Action	Description
update	Triggered when you set or update your profile picture.

The project category

Action	Description
create	Triggered when a project board is created.
rename	Triggered when a project board is renamed.
update	Triggered when a project board is updated.
delete	Triggered when a project board is deleted.
link	Triggered when a repository is linked to a project board.
unlink	Triggered when a repository is unlinked from a project board.
project.access	Triggered when a project board's visibility is changed.
update_user_permission	Triggered when an outside collaborator is added to or removed from a project board or has their permission level changed.

The public_key category

Action	Description
create	Triggered when you add a new public SSH key to your GitHub account.
delete	Triggered when you remove a public SSH key to your GitHub account.

The repo category

Action	Description
access	Triggered when you a repository you own is switched from "private" to "public" (or vice versa).
add_member	Triggered when a GitHub user is invited to have collaboration access to a repository.
add_topic	Triggered when a repository owner adds a topic to a repository.
archived	Triggered when a repository owner archives a repository.
create	Triggered when a new repository is created.
destroy	Triggered when a repository is deleted.
disable	Triggered when a repository is disabled (e.g., for insufficient funds).
enable	Triggered when a repository is re-enabled.
remove_member	Triggered when a GitHub user is removed from a repository as a collaborator.
remove_topic	Triggered when a repository owner removes a topic from a repository.
rename	Triggered when a repository is renamed.
transfer	Triggered when a repository is transferred.
transfer_start	Triggered when a repository transfer is about to occur.
unarchived	Triggered when a repository owner unarchives a repository.

The sponsors category

Action	Description
repo_funding_link_button_toggle	Triggered when you enable or disable a sponsor button in your repository (see "Displaying a sponsor button in your repository")
repo_funding_links_file_action	Triggered when you change the FUNDING file in your repository (see "Displaying a sponsor button in your repository")
sponsor_sponsorship_cancel	Triggered when you cancel a sponsorship (see "Downgrading a sponsorship")
sponsor_sponsorship_create	Triggered when you sponsor a developer (see "Sponsoring an open source contributor")
sponsor_sponsorship_preference_change	Triggered when you change whether you receive email updates from a sponsored developer (see "Managing your sponsorship")
sponsor_sponsorship_tier_change	Triggered when you upgrade or downgrade your sponsorship (see "Upgrading a sponsorship" and "Downgrading a sponsorship")
sponsored_developer_approve	Triggered when your GitHub Sponsors account is approved (see "Setting up GitHub Sponsors for your user account")
sponsored_developer_create	Triggered when your GitHub Sponsors account is created (see "Setting up GitHub Sponsors for your user account")
sponsored_developer_profile_update	Triggered when you edit your sponsored developer profile (see "Editing your profile details for GitHub Sponsors")
sponsored_developer_request_approval	Triggered when you submit your application for GitHub Sponsors for approval (see "Setting up GitHub Sponsors for your user account")
sponsored_developer_tier_description_update	Triggered when you change the description for a sponsorship tier (see "Changing your sponsorship tiers")
sponsored_developer_update_newsletter_send	Triggered when you send an email update to your sponsors (see "Contacting your sponsors")
waitlist_invite_sponsored_developer	Triggered when you are invited to join GitHub Sponsors from the waitlist (see "Setting up GitHub Sponsors for your user account")
waitlist_join	Triggered when you join the waitlist to become a sponsored developer (see "Setting up GitHub Sponsors for your user account")

The successor_invitation category

Action	Description
accept	Triggered when you accept a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
cancel	Triggered when you cancel a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
create	Triggered when you create a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
decline	Triggered when you decline a succession invitation (see "Maintaining ownership continuity of your user account's repositories")
revoke	Triggered when you revoke a succession invitation (see "Maintaining ownership continuity of your user account's repositories")

The two_factor_authentication category

Action	Description
enabled	Triggered when two-factor authentication is enabled.
disabled	Triggered when two-factor authentication is disabled.

The user category

Action	Description
add_email	Triggered when you add a new email address.
create	Triggered when you create a new user account.
remove_email	Triggered when you remove an email address.
rename	Triggered when you rename your account.
change_password	Triggered when you change your password.
forgot_password	Triggered when you ask for a password reset.
login	Triggered when you log in to GitHub.
failed_login	Triggered when you failed to log in successfully.
two_factor_requested	Triggered when GitHub asks you for your two-factor authentication code.
show_private_contributions_count	Triggered when you publicize private contributions on your profile.
hide_private_contributions_count	Triggered when you hide private contributions on your profile.
report_content	Triggered when you report an issue or pull request, or a comment on an issue, pull request, or commit.

The user_status category

Action	Description
update	Triggered when you set or change the status on your profile. For more information, see "Setting a status."
destroy	Triggered when you clear the status on your profile.

Exporting your security log

Du kannst das Protokoll als JSON-Daten oder als CSV-Datei (Comma-Separated Value) exportieren.

Um die Ergebnisse Deines Exports zu filtern, suche mit einem oder mehreren dieser unterstützten Qualifizierer, bevor Du das Dropdownmenü Export verwendest.

Qualifizierer	Beispielwert
action	team.create
actor	octocat
Benutzer	codertocat
org	octo-org
repo	octo-org/documentation
erstellt am	2019-06-01

Nachdem Du das Log als JSON oder CSV exportiert hast, siehst Du die folgenden Schlüssel und Werte in der resultierenden Datei.

Schlüssel	Beispielwert
action	team.create
actor	octocat
Benutzer	codertocat
org	octo-org
repo	octo-org/documentation
created_at	1429548104000 (der Zeitstempel gibt die Zeit in Millisekunden seit Beginn der UNIX-Zeit an)
data.hook_id	245
data.events	["issues", "issue_comment", "pull_request", "pull_request_review_comment"]
data.events_were	["push", "pull_request", "issues"]
data.target_login	octocat
data.old_user	hubot
data.team	octo-org/engineering