How to check login (including failed attempts) and PAT/SSH key activity logs in GitHub Enterprise Cloud?

[tnals724]

Select Topic Area

Question

Body

Hello,

We are using GitHub Enterprise Cloud, and I have admin privileges.
I want to check the following logs for users in our enterprise organization:
User login logs, especially failed login attempts
Creation or deletion of Personal Access Tokens (PAT) and SSH keys
Is it possible to view these via Audit Log, or is there any other method/API I should use?
I'd appreciate any guidance or documentation links.

Thanks!

[CGD595]

To check user login logs (including failed attempts) and Personal Access Token (PAT)/SSH key activity in GitHub Enterprise Cloud, you can primarily use the Audit Log and, for more detailed queries, the REST API. Below is a precise guide to address your needs:

1. Checking User Login Logs (Including Failed Attempts)

• Audit Log:
  • Navigate to the Audit Log:
    1. In GitHub, click your profile photo (top-right corner).
    2. Select Your enterprises, then choose your enterprise.
    3. Go to Settings > Audit log in the sidebar.
  • Filter for login-related events:
    • Use the search bar to filter events with the action qualifier, such as action:authentication.
    • Example query: action:authentication to find all authentication-related events, including successful and failed logins.
    • Note: Failed login attempts are not explicitly detailed in the Audit Log for GitHub Enterprise Cloud, as the focus is primarily on successful authentication events. For failed attempts, you may need to rely on other security logs or integrations (see below).
  • The Audit Log shows events like user.login for successful logins, including details like the user, timestamp, and IP address.
• Security Log (for individual user accounts):
  • If you’re checking your own account or have access to a user’s security log:
    1. Go to Settings > Security log from the user’s profile.
    2. Look for events like user.login or user.failed_login to see both successful and failed login attempts.
    • Note: Only the user themselves can access their security log unless you use Enterprise Managed Users (EMU), where enterprise admins may have access to user-specific events.
• Limitations:
  • Failed login attempts are not comprehensively logged in the enterprise Audit Log unless you’re using Enterprise Managed Users. For broader failed login tracking, consider integrating with an external identity provider (IdP) like SAML or checking IdP logs for failed attempts.
  • You may also set up audit log streaming to external systems (e.g., Azure Event Hubs, Datadog) to capture more detailed authentication data.

2. Checking PAT and SSH Key Creation/Deletion

• Audit Log:
  • In the Audit Log (accessed as described above), search for events related to PAT and SSH key activities:
    • For PATs, use qualifiers like action:personal_access_token to find events such as personal_access_token.created or personal_access_token.deleted.
    • For SSH keys, use qualifiers like action:ssh_key to find events such as ssh_key.created or ssh_key.deleted.
    • Example query: action:personal_access_token.created or action:ssh_key.deleted.
  • These events include details like the user who performed the action, the token/key involved, and the timestamp.
• Identifying Specific Token Activity:
  • To track actions performed by a specific PAT or SSH key, you need the SHA-256 hash of the token/key:
    1. Generate the hash:
       • For macOS/Linux: echo -n TOKEN | openssl dgst -sha256 -binary | base64 (replace TOKEN with the PAT or SSH key value).
       • For PowerShell: Use a script to compute the SHA-256 hash (refer to GitHub documentation for the script).
    2. Search the Audit Log with the hashed_token qualifier:
       • Example: hashed_token:"EH4L8o6PfCqipALbL+QT62lyqUtnI7ql0SPbkaQnjv8".
       • Note: This does not include Git events (e.g., pushes or pulls). For Git events, you must export the Audit Log (see below).
  • Note: SSH key and deploy key data in the Audit Log is in public preview and subject to change.

3. Using the REST API for Detailed Queries

• The REST API provides more granular access to Audit Log data, especially for automation or specific event filtering:
  • Endpoint: Use GET /enterprises/{enterprise}/audit-log to retrieve Audit Log events.
  • Authentication: Requires a personal access token (classic) with the read:audit_log scope. The authenticated user must be an enterprise admin.
  • Example Query:

    curl --header "Accept: application/vnd.github+json" \
          --header "Authorization: Bearer YOUR-TOKEN" \
          --header "X-GitHub-Api-Version: 2022-11-28" \
          'https://api.github.com/enterprises/octo-corp/audit-log?phrase=action:authentication'

    • Replace octo-corp with your enterprise slug and YOUR-TOKEN with a valid PAT.
    • For PAT/SSH key events, use phrases like action:personal_access_token.created or hashed_token:"VALUE" (URI-escaped SHA-256 hash).
  • Rate Limit: 1,750 queries per hour per user/IP.
• Exporting Git Events:
  • Git events (e.g., actions authenticated by a PAT or SSH key) are not returned in UI or API searches but can be accessed by exporting the Audit Log:
    1. In the Audit Log UI, use the Export dropdown to download the log as JSON or CSV.
    2. Look for authentication details in the exported data, which include fields related to PAT or SSH key usage for Git operations.

4. Additional Methods and Considerations

• Audit Log Streaming:
  • Stream Audit Log data to external systems (e.g., Azure Event Hubs, Datadog, Splunk) for real-time monitoring or long-term storage.
  • Configure streaming under Settings > Audit log > Log streaming in your enterprise account. This is useful for capturing comprehensive data, including authentication events.
• Webhooks:
  • For real-time notifications of specific events (e.g., PAT creation or SSH key deletion), consider setting up webhooks. Webhooks are more efficient than polling the Audit Log or API for specific events.
• SSH Key Auditing:
  • To audit SSH keys across the enterprise, site administrators can initiate an instance-wide audit:
    1. From the site admin dashboard, go to the All users tab and click Start public key audit.
    2. All SSH keys are invalidated, requiring users to approve or reject them. This ensures no unauthorized keys remain active.
  • Check for unverified keys causing Git operation failures in the user’s Settings > SSH and GPG keys section.

5. Documentation Links

• Audit Log Events for Your Enterprise
• Reviewing the Audit Log for Your Organization
• Identifying Audit Log Events Performed by an Access Token
• Auditing SSH Keys
• REST API Endpoints for Enterprise Audit Logs
• Streaming the Audit Log for Your Enterprise

Notes

• The Audit Log retains events for the last 180 days, with only the past three months displayed by default. Use the created qualifier (e.g., created:2025-01-01..2025-06-10) to filter older events.
• For failed login attempts, if not visible in the Audit Log or Security Log, check with your IdP (e.g., SAML provider) or enable audit log streaming for more comprehensive data capture.
• Always use a PAT with appropriate scopes (read:audit_log for API access) and ensure you have admin privileges for enterprise-level access.

[georgmichelle]

Specific Events to Look For:

Login Events:

user.login

user.failed_login (for failed attempts)

PAT Events:

personal_access_token.created

personal_access_token.deleted

SSH Key Events:

public_key.added

public_key.removed

Access Methods:

1. Enterprise Audit Log UI:

Go to: https://github.com/enterprises/YOUR_ENTERPRISE_NAME/settings/audit-log

2. GraphQL API (Enterprise Audit Log):

Endpoint: auditLog

Lets you filter by action, actor, date, etc

3. REST API (Organization Audit Log):

Endpoint: GET /orgs/{org}/audit-log

Filter by action like user.login, public_key.added, etc

[shinybrightstar]

Welcome to the GitHub Community, @tnals724, we're happy you're here! You are more likely to get a useful response if you are posting your question(s) in the applicable category. Check out this Guide on how to post in the right category. It'll ensure your questions and discussions reach the right people faster!

This particular discussion belongs in the Enterprise category, I've gone ahead and moved it for you. Good luck!