# Copilot Logs

Retrieves GitHub Copilot activity logs from GitHub Enterprise audit logs. Automatically filters to Copilot-related events (`action:copilot.*`).

**Sync Type: Incremental**

## Requirements

Before configuring this input, you need to:

1. **Create a Personal Access Token (PAT)** — [GitHub docs](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic).
    - Go to your GitHub settings
    - Navigate to Developer settings > Personal access tokens > Tokens (classic)
    - Click "Generate new token (classic)"
    - Select the `read:audit_log` scope
    - Copy and securely store the generated token

2. **Required Permissions**:
    - You must be an enterprise admin to access enterprise audit logs
    - The PAT must have the `read:audit_log` scope

## Configuration

### Settings

| Setting | Type | Required | Default | Description |
|---------|------|----------|---------|-------------|
| enterprise | string | Yes | - | Your GitHub enterprise slug or ID |
| bot_actions_only | boolean | No | false | When enabled, only returns events initiated by the Copilot bot (actor:Copilot). When disabled, returns all Copilot-related events including human-initiated ones. |
| backfill_start_time | string | No | - | Date to start fetching data from (ISO 8601). If not specified, no past records are fetched. |

### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| personal_access_token | string | Yes | GitHub Personal Access Token with read:audit_log scope |

## Troubleshooting

Common issues and solutions:

### 1. Rate Limit Errors
- The input automatically handles rate limiting by waiting for the reset period
- You'll see logs indicating the wait time when rate limits are hit

### 2. Authentication Errors
- Verify your PAT has the `read:audit_log` scope
- Ensure the PAT hasn't expired
- Confirm you have enterprise admin access

### 3. No Data
- Check if your enterprise slug/ID is correct
- Verify that Copilot events exist in the time range you're querying
- Ensure you have Copilot enabled in your enterprise

## Related Articles

- [GitHub Copilot Audit Log Documentation](https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-enterprise/review-audit-logs)
- [GitHub Personal Access Tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)

## Sample Record

```json
{
  "@timestamp": 1754956009902,
  "_document_id": "97b9a650-f761-bb7b-7c7d-d268c12e780a",
  "action": "copilot.add_seats",
  "actor": "admin-user",
  "actor_id": 490095,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "US"
  },
  "business": "example-inc",
  "business_id": 96281,
  "created_at": 1754956009902,
  "operation_type": "create",
  "org": "example-org",
  "org_id": 73860966,
  "user": "Alice Miller",
  "user_id": 698322
}
```