IP address metadata in Organization's audit logs [GA]

[github-product-roadmap]

Summary

GitHub previously release the ability to display IP addresses in Enterprise's audit logs. This release will extend the display of IP address metadata to Organization's audit logs. By including IP addresses in the audit log event payloads, customers will be equipped with a more robust set of data on which to perform security investigations, build threat detection models and demonstrate compliance with company and industry regulatory requirements.

Intended Outcome

Enterprise customers must be equipped with data to meet auditing, compliance and security objectives. We want enterprise administrators to have access to the data they need for the job they need to do, whether that be a compliance matter, short term security investigation or longer-term threat analysis and prevention. Displaying IP addresses in the audit log is a key piece of data for customers to develop increased understanding of user behavior to meet their compliance and security needs.

How will it work?

Actor's IP address will be displayed for audit log event meeting the following criteria:

• all organization-related events
• all events pertaining to organization-owned projects and other assets where the actor is a member of the organization.
• all events pertaining to organization-owned private and internal repos where the actor is a member of the organization.

IP address disclosure will be an opt-in feature.

[ankneis]

🚢 This has shipped: https://github.blog/changelog/2023-03-14-organization-audit-logs-include-ip-addresses-public-beta.

Leaving open to track for GHES release.

[ankneis]

🚢 This has shipped with GHES 3.9: https://docs.github.com/en/enterprise-server@3.9/admin/release-notes. Closing as complete.