Question

A security incident report indicates that a repository's default branch protection was disabled sometime between 14:00 and 15:00 UTC on a specific day. As the enterprise owner, you need to programmatically retrieve only the audit log events that occurred within that one-hour window to identify who made the change, without pulling the entire log history. Which approach lets you scope the query most precisely?

Accepted Answer

Use the audit log REST API with a phrase query that combines created:>= and created:<= timestamp qualifiers to bound the results to the incident window

Answer

Download the full audit log export as JSON from the web UI and manually search for events near the incident time

Answer

Query the audit log API filtering only on action:protected_branch.destroy, which automatically returns just the most recent matching event

Answer

Open a GitHub Support ticket requesting that support extract the relevant time window, since timestamp filtering is not exposed to administrators