Update audit log event data (#59648)

docs-bot · mchammer01 · web-flow · commit d6cb36c1204c · 2026-02-16T08:44:18.000Z
Co-authored-by: mc &lt;42146119+mchammer01@users.noreply.github.com&gt;
diff --git a/src/audit-logs/data/fpt/organization.json b/src/audit-logs/data/fpt/organization.json
@@ -8928,6 +8928,72 @@
       "operation_type"
     ]
   },
+  {
+    "action": "org.delete_custom_image",
+    "description": "A custom image was deleted for an organization.",
+    "docs_reference_links": "/actions/how-tos/manage-runners/larger-runners/use-custom-images",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "/actions/how-tos/manage-runners/larger-runners/use-custom-images"
+  },
+  {
+    "action": "org.delete_custom_image_version",
+    "description": "A custom image version was deleted for an organization.",
+    "docs_reference_links": "/actions/how-tos/manage-runners/larger-runners/use-custom-images",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "/actions/how-tos/manage-runners/larger-runners/use-custom-images"
+  },
   {
     "action": "org.disable_member_team_creation_permission",
     "description": "Team creation was limited to owners.",
@@ -12461,6 +12527,41 @@
     ],
     "docs_reference_titles": "Store information in variables"
   },
+  {
+    "action": "org.update_custom_images_policy",
+    "description": "The enterprise updated GitHub Actions custom image policy settings for an organization.",
+    "docs_reference_links": "/actions/how-tos/manage-runners/larger-runners/use-custom-images",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_policy",
+      "new_policy",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "/actions/how-tos/manage-runners/larger-runners/use-custom-images"
+  },
   {
     "action": "org.update_default_repository_permission",
     "description": "The default repository permission level for organization members was changed.",
diff --git a/src/audit-logs/data/ghec/organization.json b/src/audit-logs/data/ghec/organization.json
@@ -8928,6 +8928,72 @@
       "operation_type"
     ]
   },
+  {
+    "action": "org.delete_custom_image",
+    "description": "A custom image was deleted for an organization.",
+    "docs_reference_links": "/actions/how-tos/manage-runners/larger-runners/use-custom-images",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "/actions/how-tos/manage-runners/larger-runners/use-custom-images"
+  },
+  {
+    "action": "org.delete_custom_image_version",
+    "description": "A custom image version was deleted for an organization.",
+    "docs_reference_links": "/actions/how-tos/manage-runners/larger-runners/use-custom-images",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "/actions/how-tos/manage-runners/larger-runners/use-custom-images"
+  },
   {
     "action": "org.disable_member_team_creation_permission",
     "description": "Team creation was limited to owners.",
@@ -12461,6 +12527,41 @@
     ],
     "docs_reference_titles": "Store information in variables"
   },
+  {
+    "action": "org.update_custom_images_policy",
+    "description": "The enterprise updated GitHub Actions custom image policy settings for an organization.",
+    "docs_reference_links": "/actions/how-tos/manage-runners/larger-runners/use-custom-images",
+    "fields": [
+      "@timestamp",
+      "_document_id",
+      "action",
+      "actor",
+      "actor_id",
+      "business",
+      "business_id",
+      "hashed_token",
+      "org",
+      "org_id",
+      "programmatic_access_type",
+      "repo",
+      "repo_id",
+      "repository",
+      "repository_id",
+      "request_access_security_header",
+      "request_id",
+      "token_id",
+      "token_scopes",
+      "user",
+      "user_id",
+      "user_agent",
+      "old_policy",
+      "new_policy",
+      "created_at",
+      "operation_type",
+      "actor_is_bot"
+    ],
+    "docs_reference_titles": "/actions/how-tos/manage-runners/larger-runners/use-custom-images"
+  },
   {
     "action": "org.update_default_repository_permission",
     "description": "The default repository permission level for organization members was changed.",
diff --git a/src/audit-logs/lib/config.json b/src/audit-logs/lib/config.json
@@ -9,5 +9,5 @@
     "git": "Note: Git events have special access requirements and retention policies that differ from other audit log events. For GitHub Enterprise Cloud, access Git events via the REST API only with 7-day retention. For GitHub Enterprise Server, Git events must be enabled in audit log configuration and are not included in search results.",
     "sso_redirect": "Note: Automatically redirecting users to sign in is currently in beta for Enterprise Managed Users and subject to change."
   },
-  "sha": "6fbd793fd982298d46c7481b7d66f7f3623fb5f0"
+  "sha": "6ed0bc555c656abf9f2edbf21ec746a6b1d0b3f0"
 }

Original file line number	Diff line number	Diff line change
`@@ -9,5 +9,5 @@`
`9`	`9`	`"git": "Note: Git events have special access requirements and retention policies that differ from other audit log events. For GitHub Enterprise Cloud, access Git events via the REST API only with 7-day retention. For GitHub Enterprise Server, Git events must be enabled in audit log configuration and are not included in search results.",`
`10`	`10`	`"sso_redirect": "Note: Automatically redirecting users to sign in is currently in beta for Enterprise Managed Users and subject to change."`
`11`	`11`	`},`
`12`		`- "sha": "6fbd793fd982298d46c7481b7d66f7f3623fb5f0"`
	`12`	`+ "sha": "6ed0bc555c656abf9f2edbf21ec746a6b1d0b3f0"`
`13`	`13`	`}`