{"meta":{"title":"Reviewing audit logs for GitHub Copilot","intro":"Check for changes to settings or licenses in your Copilot plan.","product":"GitHub Copilot","breadcrumbs":[{"href":"/en/copilot","title":"GitHub Copilot"},{"href":"/en/copilot/how-tos","title":"How-tos"},{"href":"/en/copilot/how-tos/administer-copilot","title":"Administer Copilot"},{"href":"/en/copilot/how-tos/administer-copilot/manage-for-enterprise","title":"Manage for enterprise"},{"href":"/en/copilot/how-tos/administer-copilot/manage-for-enterprise/review-audit-logs","title":"Review audit logs"}],"documentType":"article"},"body":"# Reviewing audit logs for GitHub Copilot\n\nCheck for changes to settings or licenses in your Copilot plan.\n\nYou can use the audit log to review actions taken in your enterprise. The audit log includes a record of:\n\n* Changes to your Copilot plan, such as changes to settings and policies or a user losing or receiving a license\n* Agent activity on the GitHub website\n\nThe audit log does **not** include client session data, such as the prompts a user sends to Copilot locally. A custom solution is required to access this data: for example, some companies use custom hooks to send Copilot CLI events to their own logging service.\n\n## Viewing your enterprise's audit logs\n\n1. Navigate to your enterprise. For example, from the [Enterprises](https://github.com/settings/enterprises?ref_product=ghec\\&ref_type=engagement\\&ref_style=text) page on GitHub.com.\n2. At the top of the page, click **Settings**.\n3. Under \"Settings\", click **Audit log**.\n\n## Searching audit log events\n\nUse the `action:copilot` search term to view all events related to your Copilot plan.\n\nYou can also filter by a specific event. For example, `action:copilot.cfb_seat_assignment_created` returns events related to a license being assigned to a new user. For a full list of Copilot events, see [Audit log events for your enterprise](/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise) or [Audit log events for your organization](/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization).\n\nTo view a record of agent activity, use the `actor:Copilot` search term. See [Audit log events for agents](/en/copilot/reference/enterprise-administrators/agentic-audit-log-events).\n\n> \\[!NOTE]\n> For team-based seat assignments, the `copilot.cfb_seat_added` event's actor may not be the account that performed the membership change. See [GitHub Copilot seat assignment](/en/copilot/reference/copilot-billing/seat-assignment#seat-assignment-management).\n\n## Retaining audit log history\n\nThe audit log retains events for the last 180 days. We recommend streaming the audit log to a Security Information and Event Management (SIEM) platform, where you can view long-term history and set up alerts for anomalous activity. See [Streaming the audit log for your enterprise](/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise)."}