✄𐘗
text code block:
✄𐘗from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "business_advanced_security.disabled",
      "business_advanced_security.disabled_for_new_repos",
      "business_advanced_security.disabled_for_new_user_namespace_repos",
      "business_advanced_security.user_namespace_repos_disabled",
      "org.advanced_security_disabled_on_all_repos",
      "org.advanced_security_disabled_for_new_repos",
      "org.advanced_security_policy_selected_member_disabled"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.business