Vendors / GitHub / GitHub Enterprise Cloud / GitHub team member added

Event type

GitHub team member added

GitHub team.add_member audit event with registry-backed actor, target, organization and team; fresh epoch-millisecond timestamps and synthetic document ID.

JSON 8 fields Generator

github audit team

Preview Sample View Schema

CLI Install

meltr templates install github

Overview

What this event covers

Independent team.add_member snapshots matching the documented organization audit REST response. Requires source-specific entities: entities/github/enterprise-cloud/organization-audit.yaml; example configuration: configs/github/enterprise-cloud/organization-audit.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›A user is added to a team.

Security relevance

Informational

Frequency notes

One event/second for local testing; five-event example burst. No stateful membership lifecycle.

Resources

Docs and tools

Get the audit log for an organization official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

@timestamp

Integer Optional

One `now()` clock, Unix seconds through `unix_timestamp`, integer seconds × 1000 plus `clock.microsecond // 1000`. Epoch milliseconds, independent of local timezone.

Source: One `now()` clock, Unix seconds through `unix_timestamp`, integer seconds × 1000 plus `clock.microsecond // 1000`. Epoch milliseconds, independent of local timezone.

Example 1790894888166

created_at

Integer Optional

Reuses the exact same millisecond value.

Source: Reuses the exact same millisecond value.

Example 1790894888166

action

String Optional

Fixed documented value `team.add_member`.

Source: Fixed documented value `team.add_member`.

Example team.add_member

actor

String Optional

`github_login` of the user selected once by `registry.get_random_user()`.

Source: `github_login` of the user selected once by `registry.get_random_user()`.

Example ben-rivera

user

String Optional

`github_login` of `registry.get_user(actor['github_target_username'])`; distinct from actor.

Source: `github_login` of `registry.get_user(actor['github_target_username'])`; distinct from actor.

Example casey-patel

org

String Optional

`registry.get_organization()['github_org']`.

Source: `registry.get_organization()['github_org']`.

Example example-corp

team

String Optional

Same organization login + `/` + `registry.get_service('github-audit-team')['github_team_slug']`.

Source: Same organization login + `/` + `registry.get_service('github-audit-team')['github_team_slug']`.

Example example-corp/platform

_document_id

String Optional

Faker `fake.lexify` with 22 placeholders and an explicit URL-safe alphabet, sampled once per event. Opaque synthetic identifier, not an implementation of GitHub's ID algorithm; global uniqueness is not guaranteed.

Source: Faker `fake.lexify` with 22 placeholders and an explicit URL-safe alphabet, sampled once per event. Opaque synthetic identifier, not an implementation of GitHub's ID algorithm; global uniqueness is not guaranteed.

Example -W79nFuhFuJWwhvAxBwEMC