Review GitHub activity

Open Workspace > Integrations, select the connected GitHub account, then choose Activity. You need workspace Admin or Owner access and the Platform feature. Select the event family before searching or filtering it.

Choose source-event or capture datesCopy Anchor Link

Source is when the event occurred in GitHub. Received is when Sorena received an event; audit rows show Captured for the collection time instead. These times can differ. A connection's latest sync time describes a refresh and is separate from an individual event's time.

Source date from and Source date through narrow the source-event period in the panels that offer them. Received since date in Deliveries narrows when Sorena received deliveries. Use the date that matches your question, and check the row's times before connecting an event to a particular change.

DeliveriesCopy Anchor Link

A webhook delivery is a notification from GitHub received by Sorena. Choose Deliveries to inspect the verified delivery records.

1. Search the delivery evidence, then use GitHub event to choose the type of notification.
2. Enter a complete owner and repository name in Exact repository to narrow to one repository.
3. Set Received since date when you need notifications received from a particular date onwards.
4. Use Sort webhook deliveries to order by Received time, Event name, or Repository. Choose an ascending or descending Sort order and review other result pages.

Read the event and repository with the received time. This date filter does not select the original source-event period or establish that a full sync finished. Choose Clear filters to remove the criteria and restore default ordering.

Audit logCopy Anchor Link

Choose Audit log for captured GitHub organization audit history, which records actions affecting the organization.

1. Search the audit evidence and choose Actor type to distinguish human users from bots.
2. Enter Action to narrow the recorded action and Actor for the GitHub login of the person or bot that performed it.
3. Use Target repository for the repository involved and Operation type for the kind of operation.
4. Set Source date from and Source date through for the event period.
5. Use Sort audit activity to order by Source time, Action, or Actor, choose the order, and review other result pages.

Check the actor, action, and target together. Compare Source and Captured times before treating a recently collected row as a recent action. Use Clear filters to return to the broader audit history.

Security alertsCopy Anchor Link

Choose Security alerts to review alert events, then choose Security alert family: Dependabot, Code scanning, or Secret scanning.

Use Exact repository, Exact action, Exact alert state, and Exact severity to narrow the events. Enter the full repository name and the exact values you need; a broad search is useful when you do not yet know them. Set Source date from and Source date through for the period when the events occurred.

Use Sort security alert events to order by Source time, Received time, or Repository. Choose the order and review other result pages. Read the alert family, action, state, severity, and rule or secret category with the event times. Secret categories describe credential types without revealing secret values. Use Clear filters to restore the broader list. For open-alert counts, use Security evidence.

Rule changesCopy Anchor Link

Choose Rule changes, then select Rule family: Repository ruleset, Branch protection rule, or Branch protection configuration. A ruleset is a collection of repository rules; branch protection controls changes to a branch.

Use Exact repository, Exact action, and Exact enforcement to narrow the changes. Set Source date from and Source date through for the source-event period. Sort rule-change activity offers Source time, Received time, or Repository, with either sort order and result pages.

Read the rule, scope, target reference, and Resulting posture together. The resulting posture describes the recorded change; a historical row may differ from the current control. Choose Clear filters to remove criteria, and review Compliance evidence for captured control coverage.

Dismissal requestsCopy Anchor Link

Choose Dismissal requests and use Request family to separate Dismissal request from Exemption request. These are requests to dismiss an alert or seek an exception.

Narrow with Exact repository, Exact action, Exact alert family, and Exact requester. The requester is a GitHub login. Set Source date from and Source date through, then use Sort dismissal requests to order by Source time, Received time, or Repository. Choose the order and review other result pages.

Read the request family, action, state, requester, and times together before deciding what happened. This panel records activity; review and approval take place outside it. Choose Clear filters to return to the broader history.

DeploymentsCopy Anchor Link

Choose Deployments, then use Deployment event family to select Deployment, Deployment status, Deployment review, or Deployment protection rule. A deployment is a release to an environment; status, review, and protection-rule events describe different parts of that process.

Use Exact repository, Exact action, Exact environment, and Exact review decision to narrow the list. Set Source date from and Source date through for the event period. Use Sort deployment events to order by Source time, Received time, or Repository, choose the order, and check other result pages.

Read Target, State and review, Deployer or reviewer, and event times together. A deployment request, status update, and review decision do not establish the same outcome. Use Clear filters to remove the criteria and restore default ordering.

When evidence is missingCopy Anchor Link

A filtered list with no matches means no captured rows match those criteria. Clear the filters before concluding that no events were captured. A partial or unavailable capture needs a different follow-up: check the section's message, GitHub access, and capture time. Use the retry action for a loading failure or follow connection troubleshooting.

Keep filtered page addresses and private repository or user details within your authorized team. When contacting support, start with the section, time, and message shown.

Screenshots show a demo workspace.