Question

An enterprise owner is reviewing suspicious activity where several repositories had their visibility changed to public overnight. Using the audit log, they need to determine whether these changes were performed by a human clicking in the web UI or by an automated integration acting on a user's behalf. Which audit log field or approach best allows them to distinguish programmatic (token-based) actions from interactive web sessions?

Accepted Answer

Examine the programmatic_access_type (or hashed_token / actor via token) attributes to identify whether the event originated from a PAT, OAuth app, or GitHub App rather than a browser session

Answer

Filter on the actor field, since only automated integrations populate an actor value

Answer

Sort events by the created_at timestamp, because programmatic actions always occur in tight time clusters

Answer

Check the country field in the audit log, since API calls are never geolocated while web logins always are