enterprise-audit-log-investigatorlisted

# enterprise-audit-log-investigator The audit-log surface is rich but slow to search ad-hoc. This skill encodes the recurring searches as named queries so the user doesn't reinvent the syntax each time. Composes with the org's SIEM ingestion (via the S3 + KMS export path from [[audit-log-export-format]]) but works standalone via `gh api` for one-off investigations. ## When to use - Incident: "someone changed the Copilot policy at 02:00 — who?" - Quarterly audit prep: "show me all SSO events for the regulated-data orgs." - Proactive: weekly sweep for secret-scanning push-protection bypasses (the legitimate-but-overused exception path). - Triggered by a `weekly-intelligence-digest` finding about a config change at the platform level — confirm whether it's been applied. ## When NOT to use - Org-level settings comparison → `github-org-audit-runner`. - Specific user provisioning audit → use SCIM logs directly. - Continuous monitoring → that's SIEM territory. ## Canonical saved searches Each named search has: query syntax, action types, expected volume, alert threshold. ### `copilot-policy-changes` ``` gh api enterprises/{enterprise}/audit-log -X GET -f phrase='action:copilot.*' ``` **Matches**: `copilot.policy_updated`, `copilot.seat_assigned`, `copilot.seat_unassigned`, `copilot.policy_assignment_changed`, `copilot.content_exclusion_updated`. **Expected volume**: low (single-digit per day for a stable org). **Alert threshold**: more than 20 events in a 24h window, OR an